369: npm v12 Shifts the Risk to the Runtime

Dave discusses npm version 12’s decision to disable lifecycle scripts by default to improve security while potentially shifting malicious-package execution from installation time to runtime. Joining him is Darren Meyer , security leader at  Checkmarx. Darren explained that lifecycle scripts, including post-install scripts, have been a common way for attackers to execute malicious code in development environments. With scripts disabled by default, attackers may move deployment and infection code into module-loading behavior, such as execution during require or import. The change is a useful barrier, but it does not eliminate the underlying threat.