Post

How to bypass minimum dependency/release age: 1. Publish an npm package with an unpinned git dependency. 2. Get usage and wait many months. 3. Push a malicious commit to the git dependency's repo.

How to recreate leftpad: 1. Publish an npm package with a git dependency. 2. Get usage and wait many months. 3. Delete the repo.

Both of these are also possible using https dependencies in an npm package. Worst part is in some cases the package wouldn't easily be able to be taken down. npm, pnpm, and bun all happily install this kind of stuff—`deno install` errors.

Several popular npm packages transitively have this problem, including a recent popular one. It's only a matter of time before someone takes advantage of this.

You can lint against it www.npmjs.com/package/@lav...

And disable install scripts except the ones you really explicitly want www.npmjs.com/package/@lav...

It's good there's the option, but most people won't and don't do this. In my opinion, it's something that should be opt-in instead of opt-out in all the tools. For example, you can be hit by this while working on a project that doesn't have linting and you update a dependency.

Changing existing tools from opt-out to opt-in is hard. I tried some of that in conversations in npm RFC meetings back in late 2010s @pnpm.io turning off postinstall by default in v10 is the success story after the community debated it for 7 years

Additionally, pnpm 11 will block dependencies from exotic sources (like Git) in subdependencies.