npm 12 switches install scripts off by default
npm 12 switches install scripts off by default
npm 12 disables package install scripts by default, changing a long-standing behavior in the JavaScript ecosystem. The move targets a common supply-chain abuse path where malicious packages execute code during installation via lifecycle hooks in npm 12.
Operationally, this shifts package execution from implicit to explicit, reducing ambient risk in developer workstations and CI pipelines. It will also expose projects that silently depend on install-time script execution, forcing maintainers to separate legitimate build steps from a frequently abused attack surface.
️ Open sources - closed narratives
Source: Telegram "sitreports"