GitHub finally pulls the plug on automatic install script execution for npm (opens in new tab)  🔀JJ  Content type: News

The ability for attackers to leverage automatic install script execution in npm will finally come to an end when expected changes arrive from GitHub in July. Coders will still be able to enable the function, but the default setting will block it. In V12, default settings are changing, GitHub said in its changelog, noting, “it turns an npm install behavior that runs automatically today into one you explicitly opt into.” Specifically, the post said, “allowScripts defaults to off: npm install wi...