npm 12 Released: Install Scripts Off by Default as Registry Moves to Explicit Trust
npm 12 introduces significant security-related changes, making certain installation behaviors opt-in. Notably, script allowances are now off by default, which requires explicit approval for running scripts, including implicit builds. The update also restricts non-registry sources and addresses community concerns about security risks from automatic script execution. By Daniel Curtis
We haven't written up this one. InfoQ has the full story — the link below goes straight to it.
