TLDR Tech / InfoSecGitHub pulls pin on npm's auto-run scripts2026-06-12npm 12 (July) disables preinstall/install/postinstall scripts by default, requiring explicit allow-scripts allowlists.Read the full story