Friends don't let friends use NPM. At this point it is so wildly crazy watching people get owned, I don't understand how anyone uses it when they could use e.g. PNMPM and block one if the most obvious and frequently exploited holes. These tools with arbitrary code execution when trying to download some code have got to stop.

Edit: typos

Github / Microsoft could easily fix this, couldn't they? Leaving NPM up in its current state seems criminal, especially since LLMs generate NPM commands so frequently.

> Friends don't let friends ise NPM

or linkedin

>These tools with arbitrary code execution when trying to download some code have got to stop

But you still end up with the code on your machine and risk it being ran.

Bigger issue is giant, inscrutible dependency trees.

In this example, if they tried to run the test suite or application, they'd have been in the same boat.

Afaik all or most languages have some way to run arbitrary code at install time but it seems node is the main one getting targeted. I think the bigger issue here is just people running untrusted things.

I agree, but I’d extend that to any language using a package manager at this point. “A little copying is better than a little dependency” even more correct now.

All my current projects have all the code needed in the repo (unless impossible, and aside from a compiler which I guess could also be compromised)