News for hackers. Stuff that matters.

A comment on 'No way to prevent this,' says only package manager where this regularly happens. Parent comment

Re:'No way to prevent this,' says only package manager where... by tkel on Friday May 15, 2026 @10:36PM (#48156317)
Just dont use npm. Use a package manager which doesn't execute postinstall by default. The switch is incredibly simple.
[ Parent | on HN ]
Re:'No way to prevent this,' says only package manager where... by cluckindan on Friday May 15, 2026 @10:38PM (#48156332)
Which package manager is that, and what caveats does it offer?
[ Parent | on HN ]
Re:'No way to prevent this,' says only package manager where... by timfsu on Friday May 15, 2026 @10:44PM (#48156364)
Pnpm - installs are faster to boot. We haven’t missed anything
[ Parent | on HN ]
Re:'No way to prevent this,' says only package manager where... by ricardo_lien on Friday May 15, 2026 @10:44PM (#48156365)
pnpm
[ Parent | on HN ]
Re:'No way to prevent this,' says only package manager where... by joeblubaugh on Monday May 18, 2026 @04:42AM (#48176909)
It’s hard to enforce on developer machines - there are lots of ways to install npm even if you never use it for managing development dependencies.
[ Parent | on HN ]