3 ms·
point is that npm are encouraging you to use npx, which is bundled with npm 5.2+ as a general tool for executing adhoc commands from the terminal. It just massi
by phpnode 9y ago
point is that npm are encouraging you to use npx, which is bundled with npm 5.2+ as a general tool for executing adhoc commands from the terminal. It just massively increases the chance of typos.
- Spivak 9y agoAt some point there needs to be some trust, and NPM puts that boundary at installation. If you trust a package enough to install it, then it's allowed to act on your behalf with the permissions of your user. `npx` doesn't change that dynamic. It's no different than installing an RPM or Debian package over the internet.
- nulagrithom 9y agoImagine if Debian decided that `sduo rm *` meant it should apt-get install the sduo package and run immediately it. I know my systrems system wouldn't last 5 minutes.