News for hackers. Stuff that matters.
Re:NPM debug and chalk packages compromised by DDerTyp on Monday September 08, 2025 @02:55PM (#45172286)
TIL: I need to fix my CI pipeline. Gonna create a jira ticket I guess…

Thank you!

Re:NPM debug and chalk packages compromised by josefbud on Monday September 08, 2025 @03:36PM (#45172877)
Sorry, I had assumed this was what you were doing when I wrote my question but I should have specified. And sorry for now making your npm install step twice as long! ;)
Re:NPM debug and chalk packages compromised by rimunroe on Monday September 08, 2025 @03:54PM (#45173111)
npm ci should be much faster in CI as it can install dependencies directly from the lockfile rather than having to go through the whole dependency resolution algorithm. In CI environments you don't have to wait to delete a potentially large pre-existing node_modules directory since you should be starting fresh each time anyway.
Re:NPM debug and chalk packages compromised by josefbud on Monday September 08, 2025 @04:22PM (#45173457)
I've seen pipelines that cache node modules between runs to save time, but yeah if they're not doing that then you're totally right.