NPM v12 Disables Autoruns by Default

Cyber News
,
1

Huge W here. This significantly reduces the easy attack surface for NPM supply chain compromise.

Install scripts are off by default. preinstall, install, and postinstall from dependencies won’t run unless explicitly allowed.

5 Likes