NPM v12 blocks automatic installation scripts, but provides no protection against account takeovers through which attackers can inject malicious code directly as trusted releases.