npm 12 disables install scripts by default, forcing explicit approvals
npm 12 flips the default for lifecycle scripts—preinstall, install, and postinstall are blocked unless you explicitly approve them via the new allowScripts/approve‑scripts commands. The shift moves the registry to an explicit‑trust model, cutting off automatic code execution that fuels supply‑chain attacks. CI/CD pipelines must now add a script‑approval step or pin older npm versions.