NPM 12 makes install scripts, Git, and remote-url dependencies opt-in by default(github.blog)

2 pointsby slymax4 дня назад1 comments

NPM 12 makes install scripts, Git, and remote-url dependencies opt-in by default

https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/

2 comments

not saying its not moving in the right direction but i feel a lot of these things that are now security defaults are a bit oversold considering a lot of people seem to rely on them being enabled and will just enable them again to the same effect. so theres not really more security.

ofc, better defaults are better theres no argument there. just feel like the whole approach of these tools to allow arbitrary code execution and remote resources by design is the really issue,.not the default settings. (ofc, i have no solution for it too!)

Lukevigoss3 дня назад