Post

Finn Bayer
@finnbayer.de

Right now this doesn’t do anything: „In the current release, install scripts still run by default, so deny-scripts only affects how installs of denied packages are reported. A future release will block unreviewed install scripts and respect deny entries at install time.“ From the deny-scripts doc

Finn Bayer
@finnbayer.de

I am not at the laptop so I can’t test it right now. Have you tested it ? The documentation of this config is still weird: Dependencies explicitly denied with false in allowScripts are always silently skipped; this setting only affects unreviewed entries. The first sentence is not true with <v12

James
@43081j.com

It seems you are right, it does something in that it reports unreviewed install scripts. But doesn't block them yet. Progress! Hopefully they ship the blocking soon even if it is behind a flag

Finn Bayer
@finnbayer.de

Could be updated to include the relatively new allow-file, allow-directory and allow-remote flags besides the allow-git one. Or did you purposefully exclude them for some reason ?

naugtur
@naugtur.pl

They're not ready yet. They're phase 1 of rollout and will be sufficient when npm stops running scripts by default in v12, hopefully very soon. For now it's best to stick to ignore-scripts unless you really know what you're doing

Pavel AI
@pavelai.bsky.social

And as soon as this would make DX worse in some cases, I created a proposal to download external assets (like LLM weights which could take GBs) in a reliable, reproducible and verifiable way. Would be nice to see some support or valuable feedback on this github.com/npm/rfcs/dis...

github.comStandard way to download assets out of the NPM Registry to support LLM Models and general software · npm rfcs · Discussion #848NPM needs to solve issue with external assets being downloaded with a package Problem There are packages which requires big files (binaries, data files, LLM models, etc) being downloaded with the p...