Our next npm major version, v12, introduces security-related default changes to npm install . All these changes are available behind warnings in npm today on 11.16.0 or newer, so you can prepare before the upgrade. v12 is estimated to release in July 2026. Each change turns an npm install behavior that runs automatically today into one you explicitly opt into: allowScripts defaults to off: npm install will no longer execute preinstall , install , or postinstall scripts from dependencies unless they are explicitly allowed in your project. This includes native node-gyp builds (i.e., a package with a binding.gyp and no explicit install script still gets blocked, because npm runs an implicit node-gyp rebuild for it). prepare scripts from git, file, and link dependencies are blocked the same way. To see what would be blocked, run npm approve-scripts --allow-scripts-pending . Then allow the packages you trust with npm approve-scripts and block the rest with npm deny-scripts .…