Re:Fetch API has landed into Node.js
by franciscop on Tuesday February 01, 2022 @11:09AM
(#30164430)
Sorry def didn't mean in a bad way! I just wanted to ask/note that in the PR, and with the very little context I have, it seems like an arbitrary code blob so I was surprised, I'm 100% it'll be well documented in e.g. undici itself, and prob in other places.
Except that's exactly what Corepack does, just silently and opaquely on the user's system. At least, the moment it switches from opt-in to opt-out.
Its unverified binaries are just as good as random binaries, and silently replacing any pre-existing yarn/pnpm/whathaveyou without checking if it was perhaps a custom build is not exactly predictable either.
Other than Corepack, though, I think you people are doing an amazing job!
The question is totally legitimate but please assume core doesn't make "load random binary" level kind of goofs :)