SECURITYJun 11 · 06:23 UTCTHE HACKER NEWS[email protected] (The Hacker News)

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

GitHub is introducing breaking changes in npm version 12 to disable install scripts by default, aiming to prevent supply chain attacks. The update targets malicious code execution via npm lifecycle hooks during the 'npm install' command.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

GitHuborganizationnpmorganizationsupply chain attackstopicsoftware supply chain threatstopicnpm installtopicnpm lifecycle hookstopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYJun 10 · 19:41 UTC
GitHub announces npm security changes to tackle supply-chain attacks
SECURITYJun 5 · 18:05 UTC
IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks
SECURITYJun 1 · 17:40 UTC
Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
SECURITYMay 12 · 11:29 UTC
Shai Hulud attack ships signed malicious TanStack, Mistral npm packages
SECURITYApr 30 · 23:21 UTC
The never-ending supply chain attacks worm into SAP npm packages, other dev tools