npm v12 disables install scripts by default, requires allowScripts

npm v12, released on July 8, stops executing dependency lifecycle scripts—preinstall, install, postinstall—and implicit node‑gyp builds unless a package lists them in an allowScripts block in its package.json [devto]. This change forces teams to approve each script before it runs, tightening the supply‑chain attack surface.

The npm output now flags packages that request script execution, but it offers no insight into what the scripts actually do. A typical entry such as "postinstall": "node install.js" is opaque; understanding its behavior requires opening the referenced file and tracing its imports.

To make script intent visible, the author released npm‑script‑lens, an open‑source utility that parses package.json files, extracts script commands, and resolves the referenced source files. The tool produces a concise report showing which packages contain install scripts, the exact commands they run, and any external modules they load, enabling security reviewers to spot risky patterns without manual code inspection [devto]. npm‑script‑lens can be dropped into CI/CD pipelines, automating the audit step and preventing unapproved scripts from reaching production.

The practical impact is clear: teams now have a concrete method to enforce the new allowScripts policy and to maintain visibility into third‑party code execution. By surfacing script behavior and integrating with existing build workflows, npm‑script‑lens turns npm v12’s stricter defaults from a compliance hurdle into an actionable security control.