• 1 Post
  • 55 Comments
Joined 1 year ago
cake
Cake day: June 30th, 2023

help-circle













  • platypus_plumba@lemmy.worldtoProgrammer Humor@lemmy.mlFortune Teller
    link
    fedilink
    arrow-up
    9
    arrow-down
    1
    ·
    edit-2
    5 months ago

    I mean, it’s awesome until it isn’t.

    NPM is already on the “isn’t” side of it. Specially with all the malware going around. Who has time to read the code of the dependencies of the dependencies of their dependencies? For every single version. It’s just not possible…

    I guess the main concern with this is security. You’re literally running code you don’t even know about on your machine, probably next to personal files or your company’s code base.

    A simple http call to publish all your private code wouldn’t be hard to sneak in a 6th level dependency.