npm fixes
1 guide includes an npm section. This page only lists those sections. It is not a copy of the full catalog, and a sponsor does not change which guides appear or their order.
- highUpdated Oct 19, 2026
Is the npm package your AI agent added safe? in npm
npm 12.0.0, released July 8, 2026, says dependency lifecycle scripts are blocked by default unless the root package's allowScripts policy allows them. The v12 npm install-scripts docs say the same thing: install commands skip lifecycle scripts for a dependency with no matching allowScripts entry, and they list what they skipped.
Recently updated
Guides
Platform fixes
Incidents
- A crafted URL could run PowerShell on Windows through the open package, and MCP Inspector and OpenCode were affected
- Am I affected by CVE-2026-111768? One HTTP request can exhaust MCP TypeScript SDK memory
- Google's Cloud Run MCP server could send your source code to a storage bucket an attacker set up first
- One compressed request can crash a Node.js app that uses body-parser with default options
How an entry gets onto a platform page is described in the editorial standards.