← Back to context Comment by philipwhiuk 1 month ago The entire use-case of that package is a security nightmare. 7 comments philipwhiuk Reply gear54rus 1 month ago Then don't use it. Just don't presume to tell me if I can or can't. dgellow 1 month ago Given that has an impact over the whole industry, I will for sure tell you that patching on install SHOULD NOT be a thing. Up to you to run your own post install script yourself gear54rus 1 month ago [flagged] 2 replies → port11 1 month ago You’re free to allow scripts as per the linked docs for NPM 12. But the vast majority of us will appreciate the reduced attack surface. jeremyjh 1 month ago TFA explains how this works, and how to opt out.
gear54rus 1 month ago Then don't use it. Just don't presume to tell me if I can or can't. dgellow 1 month ago Given that has an impact over the whole industry, I will for sure tell you that patching on install SHOULD NOT be a thing. Up to you to run your own post install script yourself gear54rus 1 month ago [flagged] 2 replies → port11 1 month ago You’re free to allow scripts as per the linked docs for NPM 12. But the vast majority of us will appreciate the reduced attack surface. jeremyjh 1 month ago TFA explains how this works, and how to opt out.
dgellow 1 month ago Given that has an impact over the whole industry, I will for sure tell you that patching on install SHOULD NOT be a thing. Up to you to run your own post install script yourself gear54rus 1 month ago [flagged] 2 replies →
port11 1 month ago You’re free to allow scripts as per the linked docs for NPM 12. But the vast majority of us will appreciate the reduced attack surface.
Then don't use it. Just don't presume to tell me if I can or can't.
Given that has an impact over the whole industry, I will for sure tell you that patching on install SHOULD NOT be a thing. Up to you to run your own post install script yourself
[flagged]
2 replies →
You’re free to allow scripts as per the linked docs for NPM 12. But the vast majority of us will appreciate the reduced attack surface.
TFA explains how this works, and how to opt out.