{"id":182580,"date":"2026-07-09T22:53:44","date_gmt":"2026-07-09T20:53:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-npm-12-0-po-umolchaniyu-otklyuchyon-zapusk-skriptov-pri-ustanovke-paketov"},"modified":"2026-07-09T22:53:44","modified_gmt":"2026-07-09T20:53:44","slug":"v-npm-12-0-po-umolchaniyu-otklyuchyon-zapusk-skriptov-pri-ustanovke-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-npm-12-0-po-umolchaniyu-otklyuchyon-zapusk-skriptov-pri-ustanovke-paketov","title":{"rendered":"NPM 12.0-s on vaikimisi skriptide k\u00e4ivitamine pakettide installimisel keelatud","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
On 12.0 version of the NPM package manager was released, which is included with Node.js and is used for distributing JavaScript modules. The new version notably ceases the default execution of scripts during package installation. This change is intended to complicate attacks through dependency compromise and slow down the spread of worms activated by installation scripts. <\/p>\n
Skriptide automaatse k\u00e4ivitamise keelamiseks, mis on m\u00e4\u00e4ratud package.json-is preinstall, install v\u00f5i postinstall parameetritega, on lubade seade allowScripts vaikimisi seatud v\u00e4\u00e4rtusele \"off\". Sarnaste skriptide k\u00e4itamine ja C\/C++ koodi kompileerimine node-gyp utiliidi kaudu, kui pakendis on binding.gyp fail, toimub n\u00fc\u00fcd ainult siis, kui kasutajalt on saadud selge k\u00e4sk. Lisaks on parameetrite \"--allow-git\" ja \"--allow-remote\" vaikimisi v\u00e4\u00e4rtuseks n\u00fc\u00fcd \"none\", mis keelab s\u00f5ltuvuste automaatse allalaadimise Git-repositooriumidest ja otse linkidelt tar-archive'ide saitidele. <\/p>\n
Installatsiooniskriptide k\u00e4ivitamiseks tuleks kasutada k\u00e4sku \"npm approve-scripts\", mille argumendiks on usaldusv\u00e4\u00e4rsete pakettide nimed v\u00f5i valik \"--all\", et anda luba k\u00f5igile pakettidele. Kahtlaste paketide puhul on soovitatav k\u00e4ivitada k\u00e4sk \"npm approve-scripts --allow-scripts-pending\", mis kuvab nimekirja k\u00e4ivitamisele pretendeerivatest skriptidest. P\u00e4rast nende skriptide kontrollimist saab need lubada k\u00e4suga \"npm approve-scripts\" ja lisada package.json-i valge nimekirja. <\/p>\n
Additionally, the use of access GAT tokens (Granular Access Tokens) configured for performing actions without two-factor authentication (2FA) in the NPM repository has been announced as prohibited. Starting in August, such tokens will not allow operations like creating or deleting tokens, changing profile, password, or email, setting up two-factor authentication, generating recovery codes, changing access rights, and managing collaborators without further manual confirmation of actions. <\/p>\n
Jaanuaris 2027 kavatsetakse keelata pakettide otsep\u00fcsimine, kasutades 2FA \u00fcmbers\u00f5itmiseks m\u00f5eldud tokeneid. Samas saab pakette avaldada staging-jaos, kus nad viibivad kuni k\u00e4sitsi puudutamise kinnitamiseni. P\u00e4rast k\u00e4sitsi kinnitamist saavad avaldatud paketid kasutajatele installimiseks k\u00e4tte. <\/p>\n
Automaatselt avaldamiseks soovitatakse kasutada mehhanismi \"Trusted Publishers\", mis p\u00f5hineb OpenID Connect (OIDC) standardil ja autentimistokenitel, millel on piiratud kehtivusaeg. Need tokenid vahetatakse v\u00e4liste teenuste ja pakettide katalooge vahel, et kinnitada paketi avaldamise toimingut, asemel et kasutada traditsioonilisi paroole v\u00f5i p\u00fcsivaid API-juurdep\u00e4\u00e4su tokenites. \n Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"