AI Daily
Brief
Explore
Review
Sync offline
◐
← Explore
TAG
#install scripts
Stories connected through a shared idea, actor, technology or theme.
16 Aug
npm moves risky installation behaviour behind explicit approval
The new defaults block preinstall, install and postinstall scripts, implicit node-gyp builds, Git dependencies and remote tarballs unless developers explicitly allow them. npm’s migration guidance uses project allowlists and also begins deprecating sensitive two-factor-authentication-bypass granular access tokens.
→