4 ms·
This is ~solvable at a third party level. Nearly everything on NPM (the host) is MIT licensed or similar. When packages are published, run their publish lifecyc
by eyelidlessness 5y ago
This is ~solvable at a third party level. Nearly everything on NPM (the host) is MIT licensed or similar. When packages are published, run their publish lifecycle and compare to the package that’s actually published.
I don’t have the resources or bandwidth to do this, but it’s pretty straightforward +- weird publishing setups.
Edit: of course this doesn’t apply to private repositories but… you’re in a whole different world of trust at that point.
- hoten 5y agoI started working on this exact problem a few years ago. Didn't get far, though, I think I stopped because I assumed there just wouldn't be any real interest.
- hoten 5y agoI couldn't find the code, so I just started over. Haven't hosted it anywhere yet. https://github.com/connorjclark/npm-package-repro https://github.com/connorjclark/npm-package-repro
- eyelidlessness 5y agoAwesome! Thank you.