4 ms·
I do not recommend using npx. Any typo can result in downloading a malicious package published using a similar name.
by partycoder 9y ago
I do not recommend using npx. Any typo can result in downloading a malicious package published using a similar name.
- CraftThatBlock 9y agoAlthough true, it is the same for npm or yarn too. There's no real solution to the typo problem, and it's not npx specific.
- partycoder 9y agoIn a team environment npm or yarn configuration would go through peer review, whereas getting used to typing npx increases your chances of falling victim to a typo.
- CraftThatBlock 9y agoThe npx part is only to setup the project, which is making a package.json and a src directory.
- davej 9y agoThe same is true of `npm install`. Custom lifecycle scripts can be run during the install process.
- conradk 9y agoAdding "ignore-scripts=true" to your ~/.npmrc helps here.