🎯 Git dependency .npmrc override of git executable

The items that name it 2

• Socket: npm v12 Ships With Install Scripts Off by Default
  article2026-07-15

  A git dependency's .npmrc could override the git executable to run code even under --ignore-scripts; closed by --allow-git defaulting to none, first covered by Socket when it shipped behind a flag in February

• npm v12 delivers one of the biggest security improvements in years
  article2026-06-11It is written here as Git dependency npmrc override of Git executable.

  A Git dependency's npmrc can override the Git executable and run code even with --ignore-scripts set, a quieter execution path.