GitHub has revealed significant modifications set to be implemented in npm version 12, with a key change being the default disabling of install scripts. This decision is part of a broader strategy to mitigate risks associated with software supply chain vulnerabilities. The primary concern is that attackers can exploit the 'npm install' command to execute harmful code through npm lifecycle hooks. By disabling these scripts by default, GitHub aims to reduce the potential for malicious code execution during package installations. Users will still have the option to enable scripts if they choose to do so, but the default setting will prioritize security. This initiative reflects a growing awareness of the risks posed by supply chain attacks and the need for developers to adopt safer practices when managing dependencies in their projects.
GitHub to Disable Default npm Install Scripts to Enhance Security
In a move to strengthen security, GitHub will turn off npm install scripts by default in upcoming npm version 12.
