npm 12 blocks install scripts by default, tightening JavaScript supply chain security
npm v12 flips the default to disallow preinstall, install and postinstall scripts, and also blocks Git and remote URL dependencies unless explicitly approved. This forces developers to opt‑in to any lifecycle code, cutting a major attack vector that fueled recent supply‑chain breaches.