npm v12 blocks install scripts: What it means for software security

The report explains that npm v12 will stop executing dependency install-time scripts by default to block widespread supply-chain worms that exploited preinstall/postinstall hooks. Industry experts welcome the change as a major hardening step but warn it may break legitimate workflows, cause approval fatigue, and won’t eliminate other supply-chain attack vectors such as runtime malware, maintainer account takeovers, or CI/trusted-publishing abuses.