TLDR Tech / DevOps
GitHub pulls pin on npm's auto-run scripts
GitHub will make npm safer by default in npm 12 by disabling install-time scripts, Git-based dependency fetching, and remote URL downloads unless explicitly allowed, reducing common software supply chain attack vectors. Developers can still approve required packages through allowlists, though the changes are breaking and require projects to review and permit legitimate install scripts used by tools such as Playwright, Puppeteer, Electron, and native modules.
Read the full story