3 ms·
npm only lets you publish a version once, if the version number already exists for that module, you have to change the version number
by LukeB_UK 11y ago
npm only lets you publish a version once, if the version number already exists for that module, you have to change the version number
- vog 11y agoOkay, that's good to know. But I'm still uneasy with this, as the crypto hash approach provides some more safety features. For example, it protects against attacks the NPM platform itself (assuming they happen after you incorporated the library into your project). Also, it enables us to download the package from any other source (e.g. some archive/mirror), via plain HTTP, while still being safe from downloading a modified package. That's why I still wish the crypto hashes were included in package.json (automatically on "install --save-exact", of course).