Re:Embedded malware in RC (NPM package)
by jffry on Friday November 05, 2021 @07:32PM
(#29125852)
The manpage says that directly invoking a script from package.json with `npm run X` aka `npm run-script X` will still work with this preference set to true, but that it will not run pre/post scripts. Perhaps that is good enough for your use-case?
[ Parent
| on HN ]
Re:Embedded malware in RC (NPM package)
by schemescape on Friday November 05, 2021 @11:54PM
(#29127379)
Edit: That doesn't work as described on NPM 6.14.14 (the version I had), but it does work on NPM 8.1.0 (the version I just upgraded to). Thanks!
Ah, looks like it was introduced in v7.0 - https://github.com/npm/rfcs/pull/185