npm 12 Released: Install Scripts Off by Default as Registry Moves to Explicit Trust
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
npm 12 security changes, actionable for developers managing JavaScript ecosystems.
npm 12 defaults install scripts to off, requiring explicit opt-in via an allowlist in package.json, and blocks Git and remote tarball dependencies by default to close code execution vectors involved in 53% of malicious npm attacks. The change targets preinstall, install, postinstall, and implicit node-gyp builds, while community feedback warns of approval fatigue and a chicken-and-egg problem where npm approve-scripts fails on uninstalled packages. pnpm and Yarn already offered similar controls, making npm the last major package manager to adopt script allowlisting.