> npm ci Yes, that is the problem. > people use `npm install` Yes and not just in the CI but also to install CLI tools user wide on a system and similar. >

> npm ci Yes, that is the problem. > people use `npm install` Yes and not just in the CI but also to install CLI tools user wide on a system and similar. > not sure how many people actually know about `npm ci` Idk. either but `npm install` had been the default for years, and a lot of documentation is based on it. Not deprecating `npm install` or changing it's behavior is typical for the npm ecosystem, i.e. having subtle sometimes UX related security issues (at least in my experience, I doubt it got much better).