2 ms·
with npm there should be at least an option which prompts for Y/N/A when package has preinstall hook. but even this just tries to put the problem under carpet.
by mirekrusin 10y ago
with npm there should be at least an option which prompts for Y/N/A when package has preinstall hook.
but even this just tries to put the problem under carpet. you could still for example have requests package which just installs request package, works as expected, just sends request/response to your own server from time to time. ie. when there's http basic auth used only.
- seldo 10y agoIt is possible to disable install hooks at install time by running npm install with --ignore-scripts. You can also make this the default, with npm config set ignore-scripts true (and then --ignore-scripts false at install time if you wish to run them).
- zanchey 10y agoSolaris did (does?) this - "this package contains installation scripts which run as superuser" or words to that effect. Unfortunately I never found a owa to inspect the scripts directly so it wasn't all that helpful.