August 14, 2026•1 min read•from InfoQ

npm 12 Released: Install Scripts Off by Default as Registry Moves to Explicit Trust

npm 12 introduces significant security-related changes, making certain installation behaviors opt-in. Notably, script allowances are now off by default, which requires explicit approval for running scripts, including implicit builds. The update also restricts non-registry sources and addresses community concerns about security risks from automatic script execution.

By Daniel Curtis

Want to read more?

Check out the full article on the original site

View original article→

Tagged with

#npm

#scripts

#installation

#security

#explicit trust

#package manager

#registry

#automatic script execution

#security risks

#non-registry sources

#opt-in

#approval

#v12

#builds

#implicit builds

#package.json

#node.js

#dependencies

#modules

#source code