npm v12 delivers one of the biggest security improvements in years

The report describes npm's planned v12 default to stop running package install scripts, a change intended to block a recent wave of supply-chain postinstall attacks (examples include Nx s1ngularity, Shai-Hulud, the axios hijack, and Mini Shai-Hulud) that used install-time hooks and implicit builds to execute credential stealers, worms, and RATs across hundreds to thousands of packages; it advises upgrading to npm 11.16+/v12, using npm approve-scripts/deny-scripts, restricting git/remote resolution, and adopting tools like Safe Chain to reduce supply-chain infection risk.