u223344

4 ms·

1. 1.▲
   by u223344 11y ago

   According to the parent link they've been waiting for npm support to respond for a over a month.
2. 2.▲
   by u223344 11y ago

   Ironically the same person who first reported this npm vulnerability used the wrong package name uglifyjs instead of uglify-js in an unrelated github project. https://github.com/mishoo/UglifyJS2/issues/936#iss
3. 3.▲
   by u223344 11y ago

   --ignore-scripts won't help much. The act of using any npm module means you implicitly trust all the javascript code in the module and any of its dependencies. Has anyone taken the time to inspect every line of the dozens of modules th
4. 4.▲
   by u223344 11y ago

   Unfortunately native modules like canvas cannot be installed with npm install --ignore-scripts