npm v12 disables automatic installation scripts

// 52d agoPRODUCT UPDATE

npm v12 disables automatic installation scripts

The upcoming npm v12 release in July 2026 will disable automatic installation scripts, Git dependencies, and remote tarball URLs by default to secure the JavaScript supply chain. Developers must explicitly whitelist trusted dependency scripts using a new approve-scripts command that saves an allowlist to package.json.

// ANALYSIS

While disabling implicit code execution during package installation is a massive step forward for supply chain security, this shift will cause widespread friction and build failures.

* Restricting dependency scripts by default will break a huge number of popular packages that rely on native compilation, shifting the burden of trust auditing to individual developers.

* The strict Git and remote URL restrictions will force changes in enterprise CI/CD environments and private dependency management workflows.

* There is a high risk of approval fatigue, where developers simply run `npm approve-scripts` to bypass warnings and unblock their workflow without actually auditing the dependencies.

// TAGS

npmjavascriptnodejssecuritypackage-manager

DISCOVERED

52d ago

2026-06-10

PUBLISHED

52d ago

2026-06-09

RELEVANCE

8/ 10

AUTHOR

plasma

// KEEP READING

More AI developer news from the feed

EXPLORE FULL FEED

UPDATE1h ago

Genspark Workspace 6.0 drops six major updates

Genspark Workspace 6.0 expands Genspark's ecosystem across six core updates designed to bridge ambient work context into executable workflows. Key releases include SecondBrain Note hardware voice recorder, GenTeam multi-agent collaboration, GenMail email workflows, Genspark Design, AI Slides, and AgentBase for custom databases.

NEWS1h ago

Google begins active development on Gemini 4

Google is reportedly actively developing Gemini 4, its next-generation foundation model designed to be its most advanced AI system to date. Key objectives for the new model include superior reasoning skills, improved coding assistance, and enhanced agentic capabilities for autonomous task execution, while Gemini 3.5 Pro continues testing behind the scenes.

RESEARCH2h ago

MANTA enables dynamic topology adaptation for multi-agent systems

MANTA (Multi-Agent Network Topology Adaptation) is a research framework that allows multi-agent LLM systems to dynamically reconfigure their communication topologies at inference time. By combining trace auditing with verbal playbooks during execution, it enables agent teams to optimize collaboration efficiency and achieve superior results on complex benchmarks such as PlanCraft.