3 ms·

crossenv was already running the script on post install, which means it was run on "npm i crossenv" anyway.

• phpnode 9y ago
  point is that npm are encouraging you to use npx, which is bundled with npm 5.2+ as a general tool for executing adhoc commands from the terminal. It just massively increases the chance of typos.
  • Spivak 9y ago
    At some point there needs to be some trust, and NPM puts that boundary at installation. If you trust a package enough to install it, then it's allowed to act on your behalf with the permissions of your user. `npx` doesn't change that dynamic. It's no different than installing an RPM or Debian package over the internet.
    • nulagrithom 9y ago
      Imagine if Debian decided that `sduo rm *` meant it should apt-get install the sduo package and run immediately it. I know my systrems system wouldn't last 5 minutes.