software supply chain threats

GitHub is introducing breaking changes in npm version 12 to disable install scripts by default, aiming to prevent supply chain attacks. The update targets malicious code execution via npm lifecycle hooks during the 'npm install' command.

Microsoft has introduced a two-hour delay for automatic updates of Visual Studio Code extensions to mitigate software supply chain threats. This change aims to add an extra layer of protection by preventing immediate updates to newly published versions.