# npm 161 Hacker News commenters recommended npm and 461 criticized it, November 2025 to November 2026. It was recommended in 12 of 13 months. **Verdict:** Recommended for JavaScript's huge package ecosystem and easy package installs, though critics say it's a frequent supply-chain attack target and runs install scripts by default. ## Why people recommend it - Unmatched package ecosystem (4 comments): "The NPM ecosystem is a leaning tower of hacks on top of hacks and adapters for adapters, but it gets the job done." ([source](https://news.ycombinator.com/item?id=47872405)) "it's one of the strongest reasons beyond performance to use Node over some other dynamic language" ([source](https://news.ycombinator.com/item?id=49243819)) "the ecosystem really grew. There are mainstream languages that to this day still can't match npm" ([source](https://news.ycombinator.com/item?id=49256119)) - Safety settings mitigate supply-chain risk (5 comments): "Now that npm supports --before, yarn supports npmMinimumAge, and pnpm supports minimumReleaseAge, it's quite possible to stay safe" ([source](https://news.ycombinator.com/item?id=48101215)) "I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability." ([source](https://news.ycombinator.com/item?id=47583219)) "I strongly recommend the use `save-exact` in npm and only update your dependencies when you actually need to." ([source](https://news.ycombinator.com/item?id=46078874)) - Easy for beginners and tools (4 comments): "I've never written a line of JS but have installed all kinds of command line utilities with npm/npx." ([source](https://news.ycombinator.com/item?id=46796709)) "publish a wrapper around the same library and validate that it was working in maybe 10 minutes" ([source](https://news.ycombinator.com/item?id=48156362)) "nodejs and npm are easy for beginners, especially compared to the Python packaging situation" ([source](https://news.ycombinator.com/item?id=45943330)) - Has user and org namespaces (2 comments): "Even npm, probably the poster child for doing things wrong, has user- and org-based namespaces." ([source](https://news.ycombinator.com/item?id=48669951)) "NPM has at least had the good sense to use namespaces so that it isn't entirely a free for all" ([source](https://news.ycombinator.com/item?id=48642951)) ## What people warn about - Weak security against malicious packages (5 comments): "Npm, for example, is owned by Microsoft (through GitHub). MS has huge amounts of money. They could be scanning for malware on upload and adding so many more security mechanisms. But they don't." ([source](https://news.ycombinator.com/item?id=47742350)) "This is why NPM, Crates.io, etc... flatly refuse to do even the most basic security checks like adding namespaces and verifying the identity of major publishers" ([source](https://news.ycombinator.com/item?id=48156164)) "npm is uniquely bad in that regard. Refusal to implement security features that would have made attacks like this harder really doesn't help" ([source](https://news.ycombinator.com/item?id=47881992)) - Install scripts run by default (3 comments): "NPM's biggest fault is just it allows post/pre install scripts by default without user intervention." ([source](https://news.ycombinator.com/item?id=48101482)) "npms post install hook is a degree worse. Triggering during install, silently because npm didn't like someone using the feature to ask for donations" ([source](https://news.ycombinator.com/item?id=46267572)) "They will continue to enable post-install scripts for JavaScript, an interpreted language that does not have a foreign function interface." ([source](https://news.ycombinator.com/item?id=49437733)) - Fragile, bloated dependency culture (4 comments): "I've lost countless hours having to get the rube goldberg machine of npm, jest, typescript, ts-jest and other things to work together." ([source](https://news.ycombinator.com/item?id=46249432)) "people coming from the NodeJS/NPM ecosystem doing Web Scale Development(tm) and its terrible practices around dependency management" ([source](https://news.ycombinator.com/item?id=45851507)) "the whole npm system made of packages with single functions written by folks that just did their first package out of a bootcamp" ([source](https://news.ycombinator.com/item?id=49296429)) - Microsoft ownership concerns (3 comments): "Npm, for example, is owned by Microsoft (through GitHub). MS has huge amounts of money. They could be scanning for malware on upload and adding so many more security mechanisms. But they don't." ([source](https://news.ycombinator.com/item?id=47742350)) "npm is no longer a small open-source project with a federated rulership, it is owned and operated by a for-profit technological giant" ([source](https://news.ycombinator.com/item?id=49111743)) "Microsoft, as the owner of npm, has implemented a policy banning npm publishers from publishing via competitors to GitHub Actions" ([source](https://news.ycombinator.com/item?id=46191557)) ## Alternatives hackers recommend - [Nix](https://hackerapproved.com/p/nix.md): 378 recommend - [Homebrew](https://hackerapproved.com/p/homebrew.md): 271 recommend - [pnpm](https://hackerapproved.com/p/pnpm.md): 124 recommend - [Cargo](https://hackerapproved.com/p/cargo.md): 123 recommend - [GNU Guix](https://hackerapproved.com/p/gnu-guix.md): 84 recommend ## Cite as Hacker Approved, "npm", https://hackerapproved.com/p/npm/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).