4 ms·
Honestly, `npm install` should come with a big honking warning that the lockfiles will change. Or change the behaviour. This would negate this attack on 90% of
by raihansaputra 5y ago
Honestly, `npm install` should come with a big honking warning that the lockfiles will change. Or change the behaviour. This would negate this attack on 90% of the cases.
- Sander_Marechal 5y ago- `npm install` should just install what's in the lockfile - `npm update` should update the lockfile - `npm upgrade` should update the versions in package.json