> TritonInfoSec News
Home / Jul 10, 2026 / Story
0
#10 The Hacker News general July 09, 2026 at 16:49 UTC

npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk

By [email protected] (The Hacker News)

AI Summary

npm version 12 ships with install scripts disabled by default, requiring explicit opt-in via 'allowScripts,' and deprecates granular access tokens (GATs) that could bypass two-factor authentication. GitHub made the change to reduce supply chain attack surface following a series of high-profile malicious package incidents on the registry.

Read full article → https://thehackernews.com/2026/07/npm-12-disables-…

Relevance score: 74.0/100

# More from July 10

  1. 1
    15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From Google SecurityWeek
  2. 2
    Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges The Hacker News
  3. 3
    GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents The Hacker News
  4. 4
    GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses The Hacker News
  5. 5
    12 Million Impacted by Data Breach at Japanese Telco KDDI SecurityWeek
  6. 6
    Chrome 150 Update Patches 27 Vulnerabilities SecurityWeek
  7. 7
    New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware The Hacker News
  8. 8
    Interpol cybercrime crackdown nets 5,800 arrests across 97 countries CyberScoop
  9. 9
    Palo Alto Networks Patches 13 Vulnerabilities SecurityWeek