GitHub shipped npm version 12 with a fundamental default flip: dependency lifecycle scripts, preinstall, install, and postinstall, along with implicit native builds via node-gyp, no longer run automatically when a package is installed, and installing packages directly from Git repositories or remote tarball URLs is likewise blocked unless explicitly allowed. This is npm's direct response to what had become a running pattern through 2025 and into 2026: a wave of self-propagating npm worms, including the Shai-Hulud family and its variants, that specifically abused install-time lifecycle scripts to run credential-stealing malware the moment a developer or a CI pipeline ran npm install, before any application code was even executed. Making allowScripts default to off is a genuinely disruptive change rather than a quiet hardening tweak, because plenty of legitimate packages, native modules that need to compile platform-specific binaries being the most common case, rely on install scripts to function, so this update forces every team to either explicitly allowlist the scripts they actually need or accept that those packages will silently stop working until they do. For teams maintaining CI/CD pipelines, this means budgeting migration time to audit which dependencies genuinely require lifecycle scripts and configure allowlists accordingly, ideally before upgrading rather than after a build starts failing mysteriously. The broader significance is that this is one of the first times a major package manager has shipped a secure-by-default posture that actively breaks a meaningful slice of the existing ecosystem in service of supply chain security, rather than adding an opt-in scanning tool alongside the status quo, which is a notable escalation in how seriously the JavaScript ecosystem is now treating install-time code execution as an attack surface.