GitHub Introduces Automatic Controls to Prevent Malicious npm Install Scripts

GitHub is rolling out security-hardening changes in npm v12 (with opt-in warnings in npm 11.16.0+) that disable dependency install-time scripts by default (allowScripts off), restrict Git and remote tarball dependencies (--allow-git and --allow-remote default to "none"), and add an explicit approve-scripts workflow that records script allowlists in package.json; these measures aim to reduce supply-chain and install-script based attacks and require developers to review and explicitly permit trusted scripts before upgrading.