---
id: 6360
title: "npm v12’s Biggest Security Change: From Implicit to Explicit Trust"
source_domain: jfrog.com
source_url: "https://jfrog.com/blog/npm-v12-from-implicit-to-explicit-trust/"
published_at: "2026-06-18T14:15:16Z"
tags: ["supply-chain", "npm", "javascript", "shai-hulud", "package-security", "install-scripts"]
phying_url: "https://phying.com/item/6360"
lang: en
---

# npm v12’s Biggest Security Change: From Implicit to Explicit Trust

## Summary

npm v12 shifts package installation to explicit trust, blocking lifecycle scripts, Git and remote-URL dependencies by default via new allowScripts, --allow-git and --allow-remote controls.

## Intelligence Metadata

- **Sources:** jfrog.com
- **Published:** 2026-06-18T14:15:16Z
- **Original:** https://jfrog.com/blog/npm-v12-from-implicit-to-explicit-trust/
- **Phying News:** https://phying.com/item/6360