npm v12 Makes Security Default: Scripts Blocked Unless Explicitly Approved

npm v12 introduces a transformative security shift by defaulting to block installation scripts, Git dependencies, and remote URLs—requiring developers to explicitly approve what they previously received automatically. This closes known attack vectors but demands preparation: developers should test with npm 11.16.0+ and pre-approve trusted packages before the July 2026 release. The change reflects a broader industry trend: moving supply chain security from an afterthought to a foundational requirement.