As cited
Copy frozen at (site build).
Sponsored: What npm 12 fixes… and what it doesn’t
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Sponsored: What npm 12 fixes… and what it doesn’t
npm 12 disables install scripts by default to reduce attack surface, but this mitigation does not stop adversaries from embedding malicious code directly into package source code. Security teams must evaluate third-party package behavior before adoption, as the threat landscape continues to evolve beyond script-based supply chain attacks.
Why it matters: Development teams and open source package maintainers need to shift their threat model away from relying solely on install script restrictions and establish code review practices for dependencies, as attackers adapt their delivery methods.
- Source published
- First seen by Cybersecurity Tracker