logoalt Hacker News

JadoJodoyesterday at 5:09 PM1 replyview on HN

Would the adoption of a Deno-like security posture in NPM have mitigated this?


Replies

jkremsyesterday at 6:04 PM

pnpm is the better comparison maybe in this context. Most of Deno's approach to security is focussed on whole program policies which doesn't do much in this context. Just like pnpm and others, they do have opt-in for install scripts though. The npm CLI is an outlier there by now.