npm is moving install-time execution from automatic trust to explicit approval. That changes who carries the burden: maintainers now have to pre-vet legitimate scripts, because the default install path will no longer run them on its own.
GitHub says npm v12, expected in July, will block dependency preinstall, install, and postinstall scripts unless they are explicitly allowed in the project. The same rule also affects node-gyp-style builds, prepare scripts from git, file, and link dependencies, plus Git and remote URL dependencies unless they are approved; npm 11.16.0 and later will warn about installs that will fail under the new default.
For teams that rely on install scripts, the risk is operational noise and broken builds, not just blocked malware. The approval model reduces opportunistic supply-chain abuse, but it also makes legitimate installs look closer to suspicious ones until project allowlists are in place.