4 ms·
No it's to mitigate "leftpad" style attack vector.
by pxue 3y ago
No it's to mitigate "leftpad" style attack vector.
- 0xParlay 3y agoThen don't delete your lock-file and the vector doesn't exist? Rolling your own package management solution because understanding the existing tools is too hard.. That is peak "javascript sucks and I'm going to comment about it" energy lol.
- pxue 3y agoI'm not fully clear what you mean by don't delete lock file when the problem is the open source developer decides to unpublish their npm package