Summary
The new defaults block preinstall, install and postinstall scripts, implicit node-gyp builds, Git dependencies and remote tarballs unless developers explicitly allow them. npm’s migration guidance uses project allowlists and also begins deprecating sensitive two-factor-authentication-bypass granular access tokens.
Why it matters
The change alters a foundational JavaScript workflow and gives teams a stronger default boundary against dependency installation code execution, while creating migration work for native modules and build tooling.
Related coverage
- ChainDrop exposes persistence through Claude Code and VS Code configuration
- Qwen3.8-27B expands locally deployable coding models
- DeepSeek releases a plugin-oriented agent harness