npm v12 shipped on 2026-07-08 with a real security-motivated change: preinstall , install , and postinstall scripts are now disabled by default. The stated reason is legitimate — supply-chain attacks (Shai-Hulud, the Nx attack, event-stream) have repeatedly used install scripts to run arbitrary ...
Source: [Dev.to](https://dev.to/tixy/npm-v12-silently-skips-install-scripts-heres-how-to-check-if-that-breaks-you-5hmj)