techtimes

npm v12 Security Overhaul Blocks Install Scripts by Default: July Deadline for CI Migration

GitHub's npm package manager will ship its most significant security redesign in years this July, when npm v12 makes three long-automatic install behaviors require ...
GIGAZINE

The era of simply running 'npm install' to execute code is coming to an end, as npm plans to disable automated script execution by default.

The JavaScript package management tool 'npm' is scheduled to implement a change in its 'npm v12' release, which is expected in July 2026. This change will prevent the script that is automatically ...
techtimes

npm v12 Ships This Month, Blocking Install Scripts That Enabled Year of Supply Chain Attacks

JavaScript engineering teams have a shrinking window to prepare: npm v12, the package manager's most significant security redesign in its 16-year history, is expected to reach final release before the ...
InfoWorld

Your npm install was safe. What happens when the package runs?

Blocking install scripts closes one route for malicious npm packages. The malicious indexed-btree package shows why ...
CSOonline

GitHub finally pulls the plug on automatic install script execution for npm

The change, expected in July, will likely block one of the more common attack vectors; developers are wondering what took GitHub so long, and why other repositories acted so much sooner. The ability ...