Skip to content

Comment on Show HN: Tips to stay safe from NPM supply chain attacksparent

Comments

npx would resolve dependencies when the command is executed

I hate that this is becoming a thing. I was pretty miffed some time back when I realized go build just went ahead and installed a whole new version of golang on my machine. These are devtools ffs, why so much mollycoddling! And what happened to half a century of good conventions where the default is always to prompt?

And what happened to half a century of good conventions where the default is always to prompt?

The good old "be careful what you wish for" :)

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.