--- title: "npm install is (finally) getting safer" publication: "Node Weekly" issue: 628 published_at: "2026-06-11" canonical_url: "https://nodeweekly.com/issues/628" --- Plus Node-RED's major update, ESM adoption leaps forward, and exploring node_modules in 3D. #​628 β€” June 11, 2026 [Read on the Web](https://nodeweekly.com/issues/628) Together with [![Microsoft logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_280,h_60/e_make_transparent/co_white,e_outline:7/om9hjsmudy5lsvba59eb.png)](https://posetteconf.com/2026/) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/pluqg2zqfojqzsc4l3vl.jpg)](https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/) [npm v12 to Stop Running Install Scripts by Default](https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/) β€” After a year of supply chain attacks, npm v12 will no longer execute `preinstall`, `install`, or `postinstall` scripts, unless you allow them with a new `npm approve-scripts` workflow. **You can prepare today** by upgrading to [npm 11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0) which prints warnings about anything v12 _would_block. GitHub πŸ”’ `npm install` will no longer resolve git or remote URLs by default either – these can be switched on using `--allow-git` and `--allow-remote`. [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/24157603.png)](https://posetteconf.com/2026/) [Come for Great PostgreSQL Talks – Virtual and Free](https://posetteconf.com/2026/) β€” Attend talks about PostgreSQL backed app development at POSETTE: An Event for Postgres 2026 (16-18 June). Join live and chat directly with PostgreSQL speakers, other developers and users. There is also swag waiting for you. [Register for updates](https://posetteconf.com/2026/). Microsoft | AMD sponsor [Node's New Release Schedule and Version Numbers Explained](https://nodejsdesignpatterns.com/blog/nodejs-release-schedule-changes/) β€” Node’s moving to a one major release per year cadence as of Node 27 and adding a new β€˜alpha’ channel for testing and experimentation. Luciano goes deep into how it’s happening, when, and why. Luciano Mammino **IN BRIEF:** - πŸ”’ [New versions of Node.js v26.x, 24.x, and 22.x](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases) will be released on, or shortly after, Wednesday, June 17 to address security issues – the highest severity of which is 'HIGH'. - πŸ”’ As the [npm worms/supply chain attacks continue](https://www.bleepingcomputer.com/news/security/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack/), I was intrigued to see [this vulnerability report from 2016](https://www.kb.cert.org/vuls/id/319816) which predicted our current woes. - The [Drizzle ORM](https://orm.drizzle.team/) team is [𝕏 unable to publish new releases to npm](https://x.com/DrizzleORM/status/2062629339556921581) due to the registry's 100MB metadata limit. Their package currently has [1,397 versions published](https://www.npmjs.com/package/drizzle-orm?activeTab=versions) and will need some cleanup. - In less alarming registry news, an npm tooling bug briefly [marked several packages with one-character names as β€˜security holders’](https://socket.dev/blog/npm-tooling-single-character-bug) (including `c`, `i`, `n` and `x`) by mistake. A rollback is underway. πŸ“Š [ESM Provision by Popular npm Packages Sees a Big Jump](https://github.com/wooorm/npm-esm-vs-cjs#data) β€” Titus’s twice-yearly look at what popular packages ship finds 38% now expose ESM (and 16% are ESM _only_), up from 33.4% six months ago. Titus Wormer [Your Event-Driven Service Deserves an Event-Ready Database](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) β€” TimescaleDB is Postgres built for time-ordered data. Hypertables, 95% compression, continuous aggregates. [$1000 credit](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor πŸ“„ [Uncovering the Magic Behind Playwright's Fixtures API](https://ivakin.dev/blog/how-playwright-fixtures-work) – Learn how Playwright knows which fixtures your test needs just from its function signature. Vladimir Ivakin πŸ“„ [I Wish Deno Would Keep Doing What It Does Best](https://hackers.pub/@hongminhee/2026/i-wish-deno-would-keep-doing-what-it-does-best) – _β€œEarly Deno set the agenda (…) What Deno is doing now runs in the opposite direction, catching up to what the ecosystem already has.”_ Hong Minhee πŸ“„ [Creating a VS Code Agent Hook to Respond to File Changes](https://humanwhocodes.com/blog/2026/05/vscode-agent-hooks/) Nicholas C. Zakas πŸ›  Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ozu5oizurtbtf0o8rtv6.jpg)](https://nodered.org/blog/2026/06/09/version-5-0-released) [Node-RED 5.0: The Biggest Editor Overhaul in the Project's History](https://nodered.org/blog/2026/06/09/version-5-0-released) β€” The Node.js _and_ 'node'-based low-code environment gets _"the biggest change to the editor experience in [its] history"_: updated sidebars, dark theme _(above)_, pausable debug output, and the ability to call Link nodes from Function nodes. Nick O'Leary [Bonsai: A Safe Expression Language for User-Defined Rules](https://danfry1.github.io/bonsai-js/) β€” A fast, sandboxed expression language for when you need to evaluate user-supplied rules, filters, or templates without reaching for `eval`. [Try the playground.](https://danfry1.github.io/bonsai-js/playground) Daniel Fry [DepsGuard: A Tool to Harden npm, pnpm, Yarn and Bun Configs](https://depsguard.com/) β€” Can't wait for npm v12's safer defaults? This Rust-based tool audits and rewrites your package manager config, disabling install scripts, enforcing cooldowns, and blocking provenance downgrades. Arnica - ⭐ [Commander.js 15.0](https://github.com/tj/commander.js/releases/tag/v15.0.0) – The popular CLI framework is now ESM-only. v14 will be maintained till May 2027 in case you have trouble migrating. - 🎬 [NodeAV 6.0](https://seydx.github.io/node-av/) – Direct access to FFmpeg's C APIs with minimal abstractions for working with codecs, filters, streams, and more. - [Neutralinojs 6.8](https://neutralino.js.org/docs/release-notes/framework#v680) – The lightweight cross-platform app framework gets improved native file drag and drop, and a new default window policy to handle `target="_blank"` links better. - [Juice 12.1](https://github.com/Automattic/juice) – Automattic's library to inline CSS stylesheets into HTML. A common HTML email production task, [as used by](https://github.com/Automattic/juice/blob/master/PROJECTS.md) MJML and `node-email-templates`. - [Cucumber.js 13.0](https://github.com/cucumber/cucumber-js/releases/tag/v13.0.0) – The BDD test framework rebuilds its parallel runtime atop worker threads. - [Kanel 4.0](https://github.com/kristiandupont/kanel) – Generate TypeScript types from a live Postgres database. - [Envalid 8.2](https://github.com/af/envalid) – Environment variable validation library. πŸ“° Classifieds πŸ’˜ Dyno Sniper has landed! [Judoscale’s latest feature](https://judoscale.com/docs/sniper?utm_source=node-weekly&utm_medium=newsletter&utm_campaign=dyno-sniper&utm_content=solved-for-good) solves the noisy neighbor problem for good. --- πŸ“¬ Debug transactional email without leaving your dashboard. [Clerk Email Logs (beta)](https://go.clerk.com/obzqJkG) shows delivery status, bounce reasons, and open/click events. πŸ•ΉοΈ `node_modules`, Now in 3D! [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/mba2wbppbfx8s4vbh1iw.jpg)](https://nesbitt.io/heap) [Wander Around a Heap of Packages in `node_modules`](https://nesbitt.io/heap) β€” An interactive browser experience where you can navigate around a `node_modules` folder FPS-style. Which, why, how? I don’t know, but when something is by packaging expert Andrew Nesbitt of [ecosyste.ms](https://ecosyste.ms/), I check it out. Andrew Nesbitt **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).