The Pros and Cons of NPM v12's Security Improvements

The blog analyzes NPM v12's security changes — flipping dangerous defaults for install scripts, requiring explicit flags for git and remote dependencies — and explains why, despite being a positive step, these changes will not eliminate supply-chain risk. It warns that legitimate packages and native builds rely on install-time scripts and that denied defaults may train developers to approve scripts reflexively, while attackers will relocate malicious behavior to less-visible installation paths (CDNs, external scripts) making detection harder; it also highlights cooldowns and package firewalls as useful mitigations and urges teams to inventory dependencies, understand threats, and allocate time for supply-chain security.