npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk

GitHub announced npm v12 will disable dependency install scripts by default and require explicit allowlists for running lifecycle scripts, while limiting granular access tokens that bypass 2FA (removing many management and direct publish capabilities) and advising migration to trusted publishing (OIDC) or staged publishes. The note also highlights pnpm's new _auth setting to bind credentials to their host, reducing the risk of stolen tokens via tampered project files.