6 ms·
...Along with allowing packages to run arbitrary JS code when installed. That's the part that really got me. Questionable dependency practices is one thing; bu
by PeCaN 11y ago
...Along with allowing packages to run arbitrary JS code when installed.
That's the part that really got me. Questionable dependency practices is one thing; but running whatever JS when a package is installed, with no warning whatsoever, is probably a very bad idea.
A year ago I never ever would've thought I'd be happier writing C than NodeJS, but here I am. Weird how that works.
- jordigh 11y agoEssentially every package manager has to allow that, and every package manager I can think of does allow that. What's your threat model anyway? The package itself will run arbitrary code once you start using it. Is it so problematic if it starts doing that at installation instead of later?