For years, running npm install meant trusting that whatever code got pulled in would behave itself. That trust was often misplaced. Starting in July 2026, npm v12 changes the rules. Install scripts won’t run automatically anymore. Neither will dependencies be pulled from Git repos or remote URLs. All of it becomes opt-in. This is a direct response to a wave of supply chain attacks that have hammered the JavaScript ecosystem over the past year. In September 2025, attackers hijacked 18 popular npm packages — including debug and chalk — libraries found in virtually every Node.js project. With combined downloads exceeding 2.6 billion per week, it was one of the largest npm attacks in history. In 2025 alone, attackers published nearly 455,000 malicious npm packages. The attacks haven’t slowed down — the March 2026 Axios compromise weaponized one of npm’s most-downloaded packages through credential theft. The ecosystem needed a structural fix, not just better scanning t...
Internal developer platforms have become a tangled web of orchestration tools, CI runners and deployment systems that rarely speak the same language. Every new integration adds another translation layer, and as AI-driven automation starts to plug into those pipelines, the lack of a shared vocabulary for what is actually happening across the software delivery lifecycle becomes a real bottleneck. Without a consistent way to describe build, test and deploy events, both humans and agents are left stitching together logs and webhooks from systems that were never designed to interoperate. Dadisi Sanyika of the Continuous Delivery Foundation sat down with Mike Vizard to walk through how CDEvents is tackling that fragmentation. CDEvents defines a common event specification — essentially a standardized set of receipts that tools like Jenkins, Tekton and other delivery systems can emit as work moves through the pipeline. That shared semantic layer gives platform teams a reliable way to wire h...