5 ms·
I see it's been fixed by releasing 6.9.2. Does this mean you can now "brick" people's projects by sneaking npm@6.9.1 into their package.json?
by Sahhaese 7y ago
I see it's been fixed by releasing 6.9.2.
Does this mean you can now "brick" people's projects by sneaking npm@6.9.1 into their package.json?
- KhoomeiK 7y agoCertainly seems possible... Looks like I probably won't be installing anything with npm until they unpublish it.
- Ajedi32 7y agoI don't think so. NPM packages aren't installed globally by default, they're scoped to the local project via `node_modules`. So by default, the version of npm on the user's PATH wouldn't get updated.
- anc84 7y agoThe majority of npm based installation instructions I encounter "out there" are using "npm install -g".
- hombre_fatal 7y agoWell, that would be up to the user to decide. And you don't generally install project deps that way beyond some dev-deps like linters and test runners.
- WorldMaker 7y agoEven that guidance has changed with the cultural acceptance of `npx`. At this point the only thing that should be `npm install -g` is npm itself, and that only depending on your philosophy of how current you need to keep npm versus the version that ships with your NodeJS install.
- bassman9000 7y agoEveryone installs npm globally, because the whole model is broken. Which is why we keep all node env in a Docker image.