4 ms·

One thing I've never understood is why NPM allows packages to run code immediately after they are installed. What's the use case for that? A package should just

One thing I've never understood is why NPM allows packages to run code immediately after they are installed. What's the use case for that? A package should just be some code you can call on at runtime

tom1337 4mo ago
Some packages need to build native dependencies. sharp for example needs to build libvips on the system [0] to work 0: https://github.com/lovell/sharp/blob/main/install/build.js https://github.com/lovell/sharp/blob/main/install/build.js
- vinnymac 4mo ago
  I’ve always felt this automation shouldn’t exist at all, but should rather be selectively controlled via a hook. The hooks yarn offers out of the box for example can be used to run any code you need to after install. Putting the project owner in control instead of the dependency.
- yread 4mo ago
  Nuget/.NET ecosystem just handles it so much better. Netvips assumes libvips is available and they provide packages for common platforms. No need to waste electricity rebuilding stuff, or install native build chains, build and test deps. Similar for Skia or Sqlite or whatever.
  - tom1337 4mo ago
    but how can you verify that the prebuilt binaries aren’t compromised?
    - voidUpdate 4mo ago
      Out of interest, do you verify that every single binary file on your machine isn't compromised? All the packages coming from your package manager?
      - tom1337 4mo ago
        I absolutely don't. I even sometimes use "curl | bash" to install new things on my machine because most of the time it's easy and I tend to trust the authors. My point was just that I don't think moving to pre-built binaries solves this issue.
    - jcupitt 4mo ago
      sharp downloads over https and checks the sha256 (I think?) of the archive.
  - jcupitt 4mo ago
    sharp does this too: https://sharp.pixelplumbing.com/install/#prebuilt-binaries https://sharp.pixelplumbing.com/install/#prebuilt-binaries it can sometimes need to compile the C++ shim that sits between node and libvips, but that's rare.
- jcupitt 4mo ago
  sharp does not rebuild libvips, it downloads a pre-compiled libvips for your platform. https://sharp.pixelplumbing.com/install/#prebuilt-binaries https://sharp.pixelplumbing.com/install/#prebuilt-binaries It can usually also download a precompiled binary for the C++ shim that sits between node and libvips, but if your node / arch / etc. is not supported, it'll compile that (that's what the build.js file you linked does).
mark_l_watson 4mo ago
I turn off running scripts on installation. So far, no inconveniences.
jcupitt 4mo ago
Some packages with native code components (like sharp) will use these hooks to download the correct precompiled native binary for you.

tom1337 4mo ago

Some packages need to build native dependencies. sharp for example needs to build libvips on the system [0] to work 0: https://github.com/lovell/sharp/blob/main/install/build.js https://github.com/lovell/sharp/blob/main/install/build.js

vinnymac 4mo ago
I’ve always felt this automation shouldn’t exist at all, but should rather be selectively controlled via a hook. The hooks yarn offers out of the box for example can be used to run any code you need to after install. Putting the project owner in control instead of the dependency.
yread 4mo ago
Nuget/.NET ecosystem just handles it so much better. Netvips assumes libvips is available and they provide packages for common platforms. No need to waste electricity rebuilding stuff, or install native build chains, build and test deps. Similar for Skia or Sqlite or whatever.
- tom1337 4mo ago
  but how can you verify that the prebuilt binaries aren’t compromised?
  - voidUpdate 4mo ago
    Out of interest, do you verify that every single binary file on your machine isn't compromised? All the packages coming from your package manager?
    - tom1337 4mo ago
      I absolutely don't. I even sometimes use "curl | bash" to install new things on my machine because most of the time it's easy and I tend to trust the authors. My point was just that I don't think moving to pre-built binaries solves this issue.
  - jcupitt 4mo ago
    sharp downloads over https and checks the sha256 (I think?) of the archive.
- jcupitt 4mo ago
  sharp does this too: https://sharp.pixelplumbing.com/install/#prebuilt-binaries https://sharp.pixelplumbing.com/install/#prebuilt-binaries it can sometimes need to compile the C++ shim that sits between node and libvips, but that's rare.
jcupitt 4mo ago
sharp does not rebuild libvips, it downloads a pre-compiled libvips for your platform. https://sharp.pixelplumbing.com/install/#prebuilt-binaries https://sharp.pixelplumbing.com/install/#prebuilt-binaries It can usually also download a precompiled binary for the C++ shim that sits between node and libvips, but if your node / arch / etc. is not supported, it'll compile that (that's what the build.js file you linked does).

mark_l_watson 4mo ago

I turn off running scripts on installation. So far, no inconveniences.

jcupitt 4mo ago

Some packages with native code components (like sharp) will use these hooks to download the correct precompiled native binary for you.