npm v12 disables dependency install scripts by default

What happened (platform change, not an incident)

• Install scripts are off by default (reported ship date 8 Jul 2026). An `allowScripts` allowlist is created with `npm approve-scripts`. Git and remote-URL dependencies are blocked unless allowed.
• Sources disagree on whether a missing approval warns or errors. A key mitigation page for the site.

Sources

• https://thehackernews.com/2026/07/npm-12-disables-install-scripts-by.html

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.