[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNxTy-j_ipvo1dWerWSLvjDbXAEsIjx84K_0C3Se_Odg":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":118},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"f04a782a-8759-45f9-b163-259170cfda5b","NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks","npm-12-will-change-script-execution-behavior-to-prevent-supply-chain-attacks-5a22eb","By default, npm install will no longer execute scripts from dependencies, unless explicitly allowed. The post NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks appeared first on SecurityWeek.","GitHub is updating NPM to version 12, set for release in July, to prevent supply chain attacks. By default, npm install will no longer automatically execute scripts from dependencies, a method recently exploited by malware like the Shai-Hulud worm. Developers will need to explicitly allow scripts from trusted packages to maintain current functionality.","NPM 12 will block script execution from dependencies by default to prevent supply chain attacks.","https:\u002F\u002Fwww.securityweek.com\u002Fnpm-12-will-change-script-execution-behavior-to-prevent-supply-chain-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002FNPM-code-software-development.jpeg","2026-06-13T15:52:58+00:00","2026-06-13T16:00:17.078107+00:00",8,[17,20,23,26],{"name":18,"type":19},"NPM 12","product",{"name":21,"type":22},"TeamPCP","threat_actor",{"name":24,"type":25},"GitHub","vendor",{"name":27,"type":28},"npm install","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":29,"icon":31,"name":32,"slug":33},null,"Supply Chain","supply-chain",[35,37,42,47],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[24,18],{"controls":55,"vendors":112},[56,85],{"slug":57,"name":58,"problem":59,"products":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":86,"name":87,"problem":88,"products":89},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[90,98,104],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":99,"product_name":100,"url":102,"description":103},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[113],{"slug":114,"name":24,"logo_path":115,"roles":116},"github","\u002Fvendor-logos\u002Fgithub.png",[117],"reported_by",{"slug":119,"title":120,"body":121,"framework_refs":122,"framework_notes":128},"npm-12-addresses-automatic-script-execution-vulnerability-in-package-dependencies","NPM 12 Addresses Automatic Script Execution Vulnerability in Package Dependencies","The automatic execution of scripts during npm package installation created a dangerous attack vector that malware like Shai-Hulud exploited to compromise systems. By automatically running code from untrusted dependencies, developers unknowingly gave malicious packages the ability to execute arbitrary commands on their systems. NPM 12's change to require explicit approval for script execution represents a critical shift toward secure-by-default behavior. This highlights the broader risk of trusting third-party code without proper vetting and the importance of implementing least-privilege principles in development workflows.",[123,124,125,126,127],"CIS Control 2.1","NIST SP 800-161","NIST SSDF PW.4.1","ISO 27001 A.14.2.1","OWASP SCVS",{}]