npm 12 strengthens supply chain security: what changed for install scripts and tokens

Colleagues, I’d like to highlight an important cybersecurity update from the npm ecosystem.

I see several strong measures here:
• install scripts, git, and remote dependencies are now disabled by default;
• trusted scripts must be explicitly approved and added to an allowlist;
• npm tokens that bypass 2FA are losing sensitive permissions and direct publishing rights.

I would also note pnpm 11.10: structured _auth helps avoid storing token-to-host binding in project files.

Why it matters: less implicit trust means a lower risk of dependency attacks or configuration tampering.

How do you assess this shift toward stricter supply chain security?
#cybersecurity #DevSecOps #npm #SupplyChainSecurity