npm v12 broke your npm install. Here's the fix.

Every error message you'll hit upgrading to v12 — with the exact command or config to fix it. Copy, paste, move on.

Quick Reference: The 3 Config Lines That Fix 80% of Errors

Most v12 errors come from three new defaults. If you just want your CI green now and plan to audit later:

# .npmrc — restores pre-v12 behavior (not recommended long-term)
allow-scripts=true
allow-git-deps=true
allow-remote-deps=true
This is a temporary fix. These defaults exist to close supply-chain attack vectors. The goal is to migrate to explicit approvals — each error below shows the surgical fix instead of the global override.

Error Catalog

npm error Cannot run scripts for <package> — allowScripts is disabled

What it means

v12 no longer runs preinstall, install, or postinstall scripts automatically. This is the #1 breaking change — it blocks native module compilation (node-gyp rebuild) for packages like bcrypt, sharp, esbuild, and Puppeteer.

Fix (per-package approval — recommended)

# List all packages that need script approval
npm approve-scripts --allow-scripts-pending

# Approve a specific package
npm approve-scripts --allow-scripts bcrypt sharp esbuild

# Or approve everything detected (audit later)
npm approve-scripts --allow-scripts-all

Fix (global override — temporary)

# .npmrc
allow-scripts=true
npm error Git dependencies are not allowed: git://github.com/user/repo.git

What it means

v12 blocks git://, git+ssh://, git+https://, and github:user/repo dependencies by default. Git deps can override the Git executable path via .npmrc — a code-execution vector that bypasses even --ignore-scripts.

Fix (per-install flag)

npm install --allow-git

Fix (permanent config for private repos)

# .npmrc
allow-git-deps=true

Better: migrate private packages to a registry (GitHub Packages, Verdaccio, or npm private registry). Git deps skip integrity verification.

npm error Remote URL dependencies are not allowed: https://example.com/package.tgz

What it means

v12 blocks dependencies that point to remote tarball URLs. These URLs are unverifiable — the tarball content can change between installs with no integrity check.

Fix (per-install flag)

npm install --allow-remote

Fix (permanent)

# .npmrc
allow-remote-deps=true

Better: publish the package to a registry or use a local file dependency with an integrity hash.

npm error npm-shrinkwrap.json is no longer supported

What it means

v12 drops support for npm-shrinkwrap.json. If you have both a shrinkwrap and a package-lock.json, v11 already ignored the shrinkwrap — v12 removes it entirely.

Fix

# Convert shrinkwrap to package-lock.json
rm npm-shrinkwrap.json
npm install --package-lock-only

The generated package-lock.json uses lockfile v3, which is backward-compatible with npm v10/v11.

npm error code EACCES — errno -4094 — syscall mkdir

What it means

v12 enforces stricter filesystem permissions on the cache directory. If your CI cache path has wrong ownership (common when switching between root and non-root CI runners), v12 refuses to write.

Fix

# Use an absolute cache path (v12 requirement)
npm config set cache /home/runner/.npm

# Fix ownership on existing cache
sudo chown -R $(whoami) ~/.npm
npm error code EINTEGRITY — sha512 integrity check failed

What it means

v12's content-addressable cache uses SHA-512 verification. A corrupt cache entry (partial download, disk error, or registry serving different content under the same version) triggers this.

Fix

# Clear the corrupt entry and re-fetch
npm cache clean --force
npm install

If the error persists after cache clean, the registry may have republished the package with different content — check the package's npm page for a recent publish.

npm error Cannot find module — native addon not built for Node.js v22

What it means

With allowScripts off, native modules (node-gyp, prebuild-install) don't compile. Even with scripts on, a Node.js major version bump means prebuilt binaries may not exist yet.

Fix

# 1. Ensure scripts are approved for the native package
npm approve-scripts --allow-scripts bcrypt

# 2. Force rebuild
npm rebuild bcrypt

# 3. If prebuilt binaries don't exist for your Node version:
npm install bcrypt --build-from-source
npm error code ERESOLVE — unable to resolve dependency tree

What it means

v12 tightens peer dependency resolution. In v11, conflicting peer dependencies produced warnings. v12 may error on the same tree — especially if you're using --legacy-peer-deps as a permanent workaround.

Fix

# See what's conflicting
npm ls --depth=0 2>&1 | grep -E "UNMET|peer dep"

# Option A: Accept the override (v12 compatible)
npm install --legacy-peer-deps

# Option B: Fix the actual conflicts
npm install package@version --save-exact

# Option C: Override nested deps (package.json)
"overrides": {
  "react": "^19.0.0"
}
npm error Cannot read properties of null (reading 'package')

What it means

v12's arborist resolver is stricter about malformed node_modules trees. If your node_modules has orphaned symlinks or partially-installed packages (from a killed npm install), v12 may crash instead of silently repairing.

Fix

# Start fresh
rm -rf node_modules
npm install
npm error Workspace not found: packages/<name>

What it means

v12 changed how workspaces are resolved. If your package.json workspaces glob doesn't match any directories, v12 errors instead of silently skipping.

Fix

# Verify globs resolve
npm ls --workspaces --depth=0

# Check your package.json workspaces config:
"workspaces": [
  "packages/*"    // Make sure this path exists
]

CI/CD: Errors You'll Only See in Pipelines

npm error Missing script: "build" / "test" — lifecycle scripts are disabled

What it means

Your CI runs npm run build or npm test but v12's script blocking also covers your own project's scripts if ignore-scripts=true is set. This happens when a global .npmrc or CI base image sets it.

Fix

# Check what's set
npm config list | grep scripts

# If ignore-scripts=true is present, remove it:
npm config delete ignore-scripts

# Or override in your CI step:
npm install --no-ignore-scripts
npm error cache path must be absolute — got ".npm"

What it means

v12 rejects relative cache paths. Many CI configs use cache: .npm — v12 silently falls back to the default location, which means your CI cache is never actually used.

Fix

# CI config: use $CI_PROJECT_DIR or $GITHUB_WORKSPACE
npm config set cache "$CI_PROJECT_DIR/.npm"   # GitLab CI
npm config set cache "$GITHUB_WORKSPACE/.npm"  # GitHub Actions

Prevent Errors Before They Happen

The v12-Ready .npmrc Template

Drop this in your project root. It makes v12 behavior explicit — no surprises when Node.js LTS bundles v12.

# v12-ready .npmrc
# Explicitly declare what your project needs

# Scripts: list approved packages
allow-scripts=pkg1 pkg2 pkg3

# Git deps: only if you actually use them
# allow-git-deps=true

# Remote deps: almost never needed
# allow-remote-deps=true

# Cache: absolute path for CI
cache=/home/runner/.npm

# Audit: run separately, not during install
audit=false
fund=false

FAQ

How do I know which packages need script approval?

Run npm approve-scripts --allow-scripts-pending. It lists every package in your tree that has install/postinstall scripts. Most will be native modules — bcrypt, sharp, esbuild, Puppeteer, node-sass, sqlite3, etc. A typical Next.js project has 8–15 packages with scripts.

My CI passed v11 but fails v12. What changed?

Three things, in order of likelihood: (1) a native dependency no longer compiles because allowScripts is off — approve it, (2) you have a Git dependency in package.json — add --allow-git, (3) your CI cache path is relative — switch to absolute. Check the error message — it tells you exactly which of the three it is.

Can I test v12 behavior without installing v12?

Yes. npm v11.16.0+ surfaces v12 deprecation warnings during install. Run npm install --foreground-scripts to see them. Or install v12: npm install -g npm@12.

Does v12 affect npx?

No. npx behavior is unchanged. The script blocking only applies to npm install lifecycle scripts, not to the command you pass to npx.

Will npm ci still work?

Yes, with the same caveats. npm ci respects allowScripts — if a package in your lockfile has install scripts and isn't approved, npm ci will skip them. For CI, either approve the scripts explicitly or set allow-scripts=true in your CI .npmrc.

Related Guides:

Performance Guide CI/CD Pipeline v11 vs v12 ← Migration Guide

Last updated: July 1, 2026