4 ms·
I think NPM should consider flipping the default on this. Code that requires an install script should be the odd case that draws scrutiny.
by jacques_chester 5y ago
I think NPM should consider flipping the default on this. Code that requires an install script should be the odd case that draws scrutiny.
- salzig 5y agoor, cause enabled is the default right now, it's way easier to spot malicious packages right now?
- jacques_chester 5y agoI disagree. We don't know how many such packages run installation scripts without noticeably breaking.