javascript-clients VS cli

List of affected packages: https://github.com/RedHatInsights/javascript-clients/issues/...

This repository itself had to previously update from the axios supply chain attack [0] (co-authored by Claude lol). But just by looking at the change itself, the package is unpinned and won't solve the problem if it happens again as a illegitimate "security update".

So if you have an unpinned version of this package and you run 'npm install', you immediately downloaded the compromised version and that's that.

[0] https://github.com/RedHatInsights/javascript-clients/commit/...

They have taken action as of very recently. The latest version [1] of npm warns when there are install scripts and tells you they will be disabled by default in a future version, with a per-dependency opt in mechanism [2].

[1] https://github.com/npm/cli/releases/tag/v11.16.0

[2] https://github.com/npm/rfcs/pull/868

Pnpm did this first but I’m glad to see all the others follow suit

For anyone wondering, you need to be on npm >= 11.10.0 in order to use it. It just became available Feb 11 2026

https://github.com/npm/cli/releases/tag/v11.10.0

npm warn deprecated prebuild-install@7.1.3: No longer maintained. Please contact the author of the relevant native addon; alternatives are available. npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me added 624 packages in 37s 175 packages are looking for funding run `npm fund` for details npm notice npm notice New major version of npm available! 10.8.2 -> 11.11.0 npm notice Changelog: https://github.com/npm/cli/releases/tag/v11.11.0 npm notice To update run: npm install -g npm@11.11.0 npm notice ~ $

nvm npm_mirror [url]: Sets npm mirror. Default is https://github.com/npm/cli/archive/. If url is not specified, the default url is used. After setting, you can check in the settings.txt file in the installation directory, or modify it directly in that file.

I recently learned that this is a feature in npm as well: the `--before` flag to `npm install`. It was harder than it should've been to figure that out; it really needs to be better marketed.

Related to that is the proposal for `stabilityDays`, which seems way more practical: https://github.com/npm/cli/issues/8570#issuecomment-33004136.... So instead of saying "I only want package versions more than N days old", you'd be saying that "...and also they should have gone at least N days without a subsequent patch release". e.g. if mylib@6.0.0 is released, only to be quickly followed by v6.0.1 and v6.0.2, you ideally wouldn't want to risk installing the probably-broken 6.0.0 or 6.0.1 based on luck of the draw; the better behavior would be to install the previous 5.x release until 6.0.2 has aged past the threshold.

npm Repository Yarn Repository pnpm Repository