npm v12 cuts off a quiet execution path that dependency malware has used to run before any app code loads. The practical change is that preinstall, install, postinstall, and similar hooks no longer fire automatically unless a user approves them, so many install-time payloads now stop at the gate instead of running on import.
The release also blocks implicit node-gyp rebuilds by default and starts deprecating 2FA-bypass publishing tokens. That closes a gap scanners often miss, since malicious behavior can live in install-time hooks or binding.gyp-driven rebuilds rather than in the package code most reviews inspect.