npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk

GitHub has taken a significant step toward securing the JavaScript ecosystem with the release of npm version 12, fundamentally changing how package installation works by disabling install scripts by default. This proactive security measure addresses one of the most persistent vulnerabilities in the software supply chain - malicious code execution during package installation. For security professionals, this represents a critical shift in the landscape of dependency management that deserves attention and may require adjustments to existing development workflows.

The core change in npm 12 centers on the "allowScripts" setting, which now defaults to off rather than automatically executing scripts during package installation. Previously, when developers ran "npm install," any scripts included with packages would execute automatically, creating an attack vector that malicious actors could exploit. GitHub, which owns npm, has effectively closed this door by making script execution an opt-in feature rather than the default behavior. This change affects all developers and organizations using npm packages, essentially everyone in the JavaScript ecosystem, from small development teams to large enterprises. The impact extends beyond just developers to DevOps teams, security professionals, and organizations that rely on JavaScript applications. By eliminating automatic script execution, GitHub is addressing the growing threat of supply chain attacks where compromised packages can execute malicious code on development and build systems