Blocking Install Scripts Is Not a Silver Bullet

npm v12 disabling automatic install scripts is a real step forward, but it moves supply chain attacks from install-time to execution-time rather than ending them: a malicious dependency still runs the moment you import it. The article walks through the recent wave of attacks, the Node.js threat model that trusts dependency code by default, and how the permission model, sandboxing, and CI egress…