npm v12 Locks the Install Door, So Malware Turns to Runtime
npm v12 now blocks lifecycle scripts during install unless a developer explicitly approves them, killing off the easiest supply-chain malware vector. Checkmarx warns attackers will simply shift malicious payloads into runtime code, and that approval fatigue could gut the checkpoint. The door is locked, but the house is made of glass.