Tag
ignore-scripts
Safeguard articles tagged "ignore-scripts" — guides, analysis, and best practices for software supply chain and application security.
2 articles
Open Source Security
npm 12 Turned Install Scripts Off. The keyv Worm Used a preinstall Hook Anyway.
Install scripts have been off by default since npm 12 shipped in July 2026. Four weeks later a worm propagated through preinstall hooks. A default is not a control until you prove it is enforced.
Aug 5, 20266 min read
Open Source Security
npm v12 Disabled Install Scripts. Attackers Adapted in Three Days.
On 8 July 2026 npm v12 shipped with install scripts off by default — closing what GitHub called the ecosystem's largest code-execution surface. By 11 July, the jscrambler payload was executing on import instead. A study in why one-vector mitigations buy days, not years.
Jul 28, 20266 min read
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.