3 ms·
These install hooks... Why are they needed at all and why can't package (de)installation be without side effects ? I'm sure the hooks are needed for things NPM
by unilynx 6y ago
These install hooks... Why are they needed at all and why can't package (de)installation be without side effects ?
I'm sure the hooks are needed for things NPM can't do by itself, but they shouldn't run by default. That puts pressure on developers to avoid them, and puts pressure on NPM to add whatever functionality is missing from package.json in a safe way.
(and have npmjs.com search rank packages without scripts above those that do)
- bagacrap 6y agoWhat would happen if the install hooks weren't there? You'd still have client code calling into the compromised package. Would it be possible to handle those calls without knowing the symbol names used by the internal package?