3 ms·
I agree that downloading from git directly is dumb but for other reasons. Regular npm packages don't have to have any relationship to the source code repository
by from-nibly 2y ago
I agree that downloading from git directly is dumb but for other reasons. Regular npm packages don't have to have any relationship to the source code repository. You can just upload whatever files you want and call it version x and then in git tag a commit with completely different files in it.
npm doesn't review the files uploaded to npm unless there is some sort of report.
- Sophira 2y agoOh dear, I didn't realise this. I knew that GitHub Release archives could have different files in them - for example, see the xz backdoor recently - but I didn't realise that npm would use those by default.
- from-nibly 2y agoIt doesn't use the releases. It just bundles up whatever files you tell it to.