GitHub has released npm version 12 with install scripts disabled by default and granular access tokens that bypass two-factor authentication deprecated, a pair of changes aimed squarely at software supply chain attacks, as reported by The Hacker News.

Install scripts have been a favorite of attackers for years. A malicious package did not need a victim to import or run it, it only needed to be installed, because the install step itself could execute arbitrary code. Turning that off by default removes one of the most reliable ways a poisoned dependency turned a simple install into a full compromise.

The timing tracks with a steady drip of npm incidents, including a recent case where the Injective Labs SDK was used to publish a package that stole cryptocurrency wallet keys. When the registry sitting under most of the world's JavaScript is a repeated target, changing the defaults is worth more than any single takedown.

The tradeoff is friction. Some legitimate packages rely on install scripts for native builds and setup, and those workflows will need to opt in or adjust. That is the right direction anyway. A default that is safe for the many and mildly inconvenient for the few beats a default that was convenient for everyone, including the attacker.

Sources: The Hacker News.