npm 12 Released: Install Scripts Off by Default as Registry Moves to Explicit Trust

Automated news aggregation. Headlines and summaries are gathered from public feeds; see our editorial standards for sourcing, corrections, and AI-assist disclosure.

npm 12 introduces significant security-related changes, making certain installation behaviors opt-in. Notably, script allowances are now off by default, which requires explicit approval for running scripts, including implicit builds. The update also restricts non-registry sources and addresses community concerns about security risks from automatic script execution. By Daniel Curtis