3 ms·
> Blindly running code from GitHub can be detrimental And this is exactly why I dislike how most dependency managers nowadays (especially npm) use GitHub direc
by Sophira 2y ago
> Blindly running code from GitHub can be detrimental
And this is exactly why I dislike how most dependency managers nowadays (especially npm) use GitHub directly. I prefer something where somebody other than the dev has reviewed the code. As it is, I could be installing literally anything.
- from-nibly 2y agoI agree that downloading from git directly is dumb but for other reasons. Regular npm packages don't have to have any relationship to the source code repository. You can just upload whatever files you want and call it version x and then in git tag a commit with completely different files in it. npm doesn't review the files uploaded to npm unless there is some sort of report.
- Sophira 2y agoOh dear, I didn't realise this. I knew that GitHub Release archives could have different files in them - for example, see the xz backdoor recently - but I didn't realise that npm would use those by default.
- from-nibly 2y agoIt doesn't use the releases. It just bundles up whatever files you tell it to.