npm

“One must be crazy to run third-party software (including package managers like npm) unrestricted”

“attackers are publishing "internal-package-a@999.9.9" on any public package host (NPM, PyPi, etc)”

“for me NPM is the best tool, is not that fast, but the installation speed is not that bad”

“They will continue to enable post-install scripts for JavaScript, an interpreted language that does not have a foreign function interface.”

“the whole npm system made of packages with single functions written by folks that just did their first package out of a bootcamp”

“the ecosystem really grew. There are mainstream languages that to this day still can't match npm”

“it's one of the strongest reasons beyond performance to use Node over some other dynamic language”

“npm is no longer a small open-source project with a federated rulership, it is owned and operated by a for-profit technological giant”

“It's great for ensuring your devs don't break the freaking build by updating something with npm, etc.”

“Even npm, probably the poster child for doing things wrong, has user- and org-based namespaces.”

“NPM has at least had the good sense to use namespaces so that it isn't entirely a free for all”

“the NPM and cargo registries handle way more traffic and visibility and doesn't have any issues like this”

“I guess their support is run by LLM because you can just write to them and they will transfer ownership of any module nilly willy”

“We need to encourage the community to adopt these publishing protections or this will continue to be an issue.”

“trust that NPM at least gets their "you can't republish to an old version" bare-minimum constraint right”

“publish a wrapper around the same library and validate that it was working in maybe 10 minutes”

“This is why NPM, Crates.io, etc... flatly refuse to do even the most basic security checks like adding namespaces and verifying the identity of major publishers”

“NPM's biggest fault is just it allows post/pre install scripts by default without user intervention.”

“You can limit yourself to pre-scanned packages by setting npm's minimum release age setting to 1 or 2 days”

“Now that npm supports --before, yarn supports npmMinimumAge, and pnpm supports minimumReleaseAge, it's quite possible to stay safe”

“Almost all security vulnerabilities I've personally seen flagged through npm are about things I only use at build-time”

“imagine where the JavaScript ecosystem would be if packages like is-array and left-pad couldn't get accepted to npm”

“npm is uniquely bad in that regard. Refusal to implement security features that would have made attacks like this harder really doesn't help”

“The NPM ecosystem is a leaning tower of hacks on top of hacks and adapters for adapters, but it gets the job done.”

“Npm, for example, is owned by Microsoft (through GitHub). MS has huge amounts of money. They could be scanning for malware on upload and adding so many more security mechanisms. But they don't.”

“I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability.”

“if you use SIP and use package managers (npm, cargo, pip, etc) outside of a VM you are substantially more vulnerable to attack”

“NPM+Yarn+$package-package-manager of the day to solve the problems the whole ecosystem and the so-called solutions creates twice”

“NPM, PyPI, Cargo et. al. continue to think they can short circuit that process and still ship safe software, and they verifiably cannot.”

“as it eliminated long lived access tokens for publishing, it encourages people to use "trusted publishing"”

“npm never has "version lock" where it can't figure out a valid solution to the version constraints”

“I've never written a line of JS but have installed all kinds of command line utilities with npm/npx.”

“The npm community is too big that one can never discard it for frontend development.”

“npms post install hook is a degree worse. Triggering during install, silently because npm didn't like someone using the feature to ask for donations”

“I've lost countless hours having to get the rube goldberg machine of npm, jest, typescript, ts-jest and other things to work together.”

“Microsoft, as the owner of npm, has implemented a policy banning npm publishers from publishing via competitors to GitHub Actions”

“I strongly recommend the use `save-exact` in npm and only update your dependencies when you actually need to.”

“At least with NPM we can pull in updated versions with NPM tells us that we're running an outdated version.”

“nodejs and npm are easy for beginners, especially compared to the Python packaging situation”

“people coming from the NodeJS/NPM ecosystem doing Web Scale Development(tm) and its terrible practices around dependency management”