HomeAI · summaries
Storia in 6 fonti
GitHub finally pulls the plug on automatic install script execution for npm
The change, expected in July, will likely block one of the more common attack vectors; developers are wondering what took GitHub so long, and why other repositories acted so much sooner.
Confronto fonti
6 prospettive sulla stessa storiaTimeline cronologica
- ·
github.blog
Upcoming breaking changes for npm v12 - GitHub Changelog
Our next npm major version, v12, introduces security-related default changes to npm install. All these changes are available behind warnings in npm today on 11.16.0 or newer, so…
- ·
infoworld.com
GitHub finally pulls the plug on automatic install script execution for npm
The change, expected in July, will likely block one of the more common attack vectors; developers are wondering what took GitHub so long, and why other repositories acted so much…
- ·
heise.de
npm packt seine riskantesten Sicherheitsprobleme an
Mit npm v12 schließt GitHub einen zentralen Angriffsweg: Installationsskripte aus Abhängigkeiten laufen ab Juli 2026 nur noch nach ausdrücklicher Freigabe.
- ·
theregister.com
GitHub pulls pin on npm's auto-run scripts
Shai-Hulud worm exploited exactly this. Better late than never, says everyone except the malware authors
- ·
bleepingcomputer.com
GitHub announces npm security changes to tackle supply-chain attacks
GitHub has announced that npm v12, expected next month, will introduce several security-focused changes aimed at blocking supply-chain attacks abusing behaviors triggered by the…
- ·
thehackernews.com
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
npm 12 disables install scripts by default, requiring explicit approval to reduce dependency-based code execution risks.