NEWS
npm 12 turns on install-time security defaults and phases out 2FA-bypass tokens
npm 12 now blocks dependency install scripts, Git dependencies, and remote tarballs by default while GitHub phases out high-risk 2FA-bypass token operations.
Jul 09, 2026 4 min read Medium