5 ms·
Why the hell does npm support a postinstall script? There really shouldn't be a need to run arbitrary code provided by the package for something like this.
by broeng 2y ago
Why the hell does npm support a postinstall script? There really shouldn't be a need to run arbitrary code provided by the package for something like this.
- ErikBjare 2y agoIt also supports preinstall and install scripts, for more obvious reasons.
- broeng 2y agoI don't really think thats more obvious. It's expected to install dev libraries, not system services, it shouldn't have that need.
- deafpolygon 2y agodependency checking isn't simple
- andyferris 2y agoNodeJS isn't very sandboxed. Many "dev libraries" are native and will either download and link to binary blobs, or build e.g. C code, which AFAICT is what all the various install scripts are for.
- broeng 2y agoIt seems like a bad design choice, that, besides allowing for running untrusted code directly at download time, also makes it difficult to properly mirror artifacts, and I'd assume, make platform portability inconsistent, at best.
- nijave 2y agoThe package itself is arbitrary code. You're running arbitrary code either way whether it's preinstall, install, post install, or when the package code gets ran. It's common to need to setup tool chains for code that gets compiled (i.e. a node module that adds language bindings to a C library)