npm v12 disables install scripts by default, tightening supply‑chain security
GitHub’s npm v12 will turn off pre‑install, install and post‑install scripts, block Git‑sourced packages and remote URL downloads unless explicitly allowed. This shift stops a major code‑execution surface, forcing developers to whitelist trusted scripts and reducing supply‑chain attack risk.