4 ms·
The black hole that is node_modules? Like, it’s fine for my personal projects, but every time I install the project I implicitly trust some 2000 authors to not
by Aeolun 3y ago
The black hole that is node_modules? Like, it’s fine for my personal projects, but every time I install the project I implicitly trust some 2000 authors to not have added “rm -rf /“ to their installation scripts.
Ideally I wouldn’t have to worry about that.
- ivanjermakov 3y agoYou have to have this trust with any software you're using. Is not feasible to inspect source and install from source every package/library you use. Any of them can hypothetically run rm rf and include it even in a minor update.
- subtra3t 3y agoBut that risk is relatively small when you're using 2-3 packages that are very popular compared to 200-300 packages, most of which will be esoteric one liners.
- ivanjermakov 3y agoTrue, but only if these popular packages treat their own dependencies cautiously.