4 ms·
True, but it's now no longer possible to remove a package from npm, which kind of solves this module resolution problem. However a malicious actor could still
by gitgud 8y ago
True, but it's now no longer possible to remove a package from npm, which kind of solves this module resolution problem.
However a malicious actor could still upload a broken minor version that most node projects would try to automatically resolve to, and thus break...
- dangerface 8y ago> which kind of solves this module resolution problem Your exception is not limited to malicious actors as even ligitmate packages like uglifyjs have had to do this. The NPM developers themselves have no problem deleting packages which would result in the same problems. They solved their problem by pushing it onto the rest of us.