3 ms·
Re https://github.com/npm/rfcs/pull/488 https://github.com/npm/rfcs/pull/488. Thank you for your service! I had this on my TODO for months. Actually I just use
by theteapot 5y ago
Re https://github.com/npm/rfcs/pull/488 https://github.com/npm/rfcs/pull/488. Thank you for your service! I had this on my TODO for months. Actually I just use yarn now where ever possible and set `enableScripts: false` both globally and per package. Doesn't solve all of the npm ecosystem's sec issues (like allowing downloading binary blobs and other assets from arbitrary URLs, no cleaning on permission bits on archives, not blacklisting certain typo-esque package names, ...) but it's clear low hanging fruit and the push-back from maintainers is really crazy ...