GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

GitHub is disabling npm install scripts by default in version 12 to prevent supply chain attacks.

• •npm install currently executes preinstall, install, and postinstall scripts from all transitive dependencies without explicit approval
• •A single compromised package in the dependency tree can execute arbitrary code on developer machines or CI runners
• •Version 12 will require explicit approval for script execution, git dependencies, and remote URL dependencies
• •Developers should upgrade to npm 11.16.0+ and use npm approve-scripts --allow-scripts-pending to review and approve trusted packages

This summary was automatically generated by AI based on the original article and may not be fully accurate.