Vercel now blocks bad npm packages; the npm in every Node LTS still runs install scripts

On 2 November 2026 Vercel started checking every new build on every plan against a list of npm package versions it has marked as malware or dangerously flawed ¹. It reads the lockfile before installing, including packages restored from the build cache, and blocks downloads of listed versions during the install. A match fails the deployment and names the package and version ¹. npm is the public registry of JavaScript packages that almost every web app pulls in by the hundred.

This protects the build. It does not reach the machine where the package first arrives. An app built with Cursor, Lovable, Bolt or Claude Code gets its packages installed on the founder's laptop or in the tool's own environment, and a malicious package does its damage at that moment: its install script runs. An install script is a program a package asks to run on your computer when it is installed, before your app ever starts. It runs with your user's access to files, saved keys and tokens.

The npm that ships with Node runs install scripts by default

npm 12.0.0, released 8 July 2026, blocks dependency install scripts unless the project approves them ². No long-term-support (LTS) release of Node.js ships npm 12. Node's release table, read today ⁴:

min-release-age arrived in npm 11.10.0 on 11 February 2026 ². It makes npm install only versions published more than a given number of days ago ³. A delay gives the registry and lists such as Vercel's time to catch a poisoned release before it reaches your machine. Vercel's own page says new rules typically reach builds "within minutes" ¹; a version nobody has listed yet installs everywhere, Vercel included.

Tested: what each npm does with a script-carrying package

We built a test package whose install script writes a file, then installed it into an empty project with each npm. Measured 3 November 2026 on macOS, Node.js 24.7.0. npm 12.2.1 printed a warning that it supports Node 24 from 24.15.0; it ran.

The same day next had a release 13 hours old, 16.4.4, and one from 23 October, 16.4.3. Installing next with no version:

pnpm, the other common package manager, already waits a day and blocks unapproved build scripts by default ⁵⁶. For a project on npm, two lines bring npm 11 most of the way there.

The fix: two lines in .npmrc, and npm 11.10 or newer

Create a file named .npmrc in the project's root folder, next to package.json:

min-release-age=7
strict-allow-scripts=true

Then check the npm version, and upgrade if it is below 11.10:

npm --version
npm install -g npm@11

.npmrc travels with the repository, so the laptop, the AI tool's environment and any build server that runs npm 11.10 or newer read the same rules. npm 10 ignores both lines and prints "Unknown project config"; that warning means the machine still runs every script.

With the strict setting on, the first install that meets a package with an install script stops and lists it. Some packages need theirs: esbuild, sharp and database drivers fetch or compile a binary for the computer they land on. The approval takes four commands, tested on npm 11.19.1 with esbuild and next:

npm install --ignore-scripts
npm install-scripts approve esbuild
npm rebuild
npm ci

The approval lands in package.json pinned to the exact version, "allowScripts": {"esbuild@0.28.2": true} ³. We changed the pin to 0.28.1 and ran npm ci again: it stopped with ESTRICTALLOWSCRIPTS. A new version of a package needs a new yes, so a hijacked release cannot run its script on the strength of an old one. In our test next 16.4.3 installed with no approval at all, since it has no install script of its own.

Three cases this does not cover

• Urgent security fixes. A seven-day delay also holds back a patch published today. Install that one by hand with an exact version, npm install next@16.4.4, or list the package in min-release-age-exclude ².
• Malicious code that runs later. Blocking install scripts stops the attack at install time. A package that carries its payload in the code your app imports still runs when the app runs; the delay and lists like Vercel's are the defence there ¹.
• Tools that bring their own npm. An AI tool's environment uses whatever npm its maker installed. npm --version in the tool's terminal says which; below 11.10, the .npmrc lines are ignored there.