[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKjTZC_kRF7NZutVucVSyjBqmMAeGQH9mrpPEmFQwRpo":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":108},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"14168615-fd5f-4c65-a393-9b26bd299283","npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk","npm-12-disables-install-scripts-by-default-to-reduce-supply-chain-risk-470b8a","GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with deprecating granular access tokens (GATs) designed to bypass two-factor authentication (2FA). The Microsoft-owned subsidiary noted that the following npm install behaviors that used to run automatically before have been made opt-in - allowScripts defaults to off, meaning","GitHub has released npm version 12, disabling install scripts by default to enhance supply chain security. This change requires explicit user approval for dependency lifecycle scripts and implicit node-gyp builds. Additionally, granular access tokens (GATs) that bypass two-factor authentication (2FA) will have their capabilities restricted, limiting sensitive account and package management actions.","npm 12 disables install scripts by default to mitigate supply chain risks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fnpm-12-disables-install-scripts-by.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhbP2w2lzNWbB041oSXvx2Nb1uOJaf81XNUBioDv_3K73S-JnzIU4OnUHfwG3Q3RLbf_p2wJBpHC0m2M4cQhCMfcSRRx1MY9n2vCVSNI4ddai3uJ3eE2Kb-d_ryU_HSEx_R2Rjoxz2D3TBcZCgLRWf-rOBf9k73Vi1Q04aWNG9Ux-A5AOf-v1HjSGD3YZcg\u002Fs1600\u002Fnpm-security.jpg","2026-07-09T16:49:02+00:00","2026-07-09T18:00:06.122412+00:00",8,[17,20,23,25],{"name":18,"type":19},"npm","product",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":22},"Microsoft",{"name":26,"type":19},"pnpm","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":27,"icon":29,"name":30,"slug":31},null,"Supply Chain","supply-chain",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[],[24,21,18],{"controls":53,"vendors":104},[54,82],{"slug":55,"name":56,"problem":57,"products":58},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[59,67,74],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":68,"vendor_name":21,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":83,"name":84,"problem":85,"products":86},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":68,"vendor_name":21,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},[105],{"slug":68,"name":21,"logo_path":69,"roles":106},[107],"reported_by",{"slug":109,"title":110,"body":111,"framework_refs":112,"framework_notes":122},"npm-12-tightens-supply-chain-defenses-by-disabling-install-scripts-by-default","npm 12 Tightens Supply Chain Defenses by Disabling Install Scripts by Default","Malicious actors have long exploited npm lifecycle scripts (such as `preinstall` and `postinstall`) to execute arbitrary code the moment a dependency is installed, making the software supply chain a prime attack vector. By disabling these scripts by default, npm 12 forces developers to consciously approve execution, reducing the risk of silent, automated compromise. Additionally, restricting granular access tokens that could bypass 2FA closes a significant authentication gap that attackers have used to hijack package accounts and push malicious updates. These changes highlight how default-permissive configurations in developer tooling can create systemic risk across thousands of downstream projects. Organizations that have not reviewed their npm configurations or token management practices remain exposed to supply chain attacks even if their own code is clean.",[113,114,115,116,117,118,119,120,121],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 CM-7: Least Functionality","NIST SSDF PW.4: Reuse Existing, Well-Secured Software","SLSA Supply Chain Levels for Software Artifacts (Levels 2–3)","OpenSSF Scorecard: Token-Permissions and Dangerous-Workflow checks",{}]