npm-lint VS just

That postinstall and other scripts have been a problem for a long time - the PoC for example could be installed via npx, which would then run postinstall which executes another script to steal /etc/password data.

This is not a new problem, you just have another vector.

I came up with a free linter package to try solve it - but no one seemed interested, and here we are 7 later talking about where people are now offering paid services to mitigate it.

https://github.com/tanepiper/npm-lint

Also ended up writing a similar tool but didn't take it much further.

I did try come up with a npm linter but never really completed it.

A while back I wrote a opt-in tool called npl-lint[1] that would allow some CI-level enforcement of rules in package.json although I didn't go too far with it - one thing was to check the scripts section and allow whitelisted apps, or whitelisted sources for dependencies.

It came about because I ended up having a spat with one of the NPM engineers at the time because they launched npx with the ability to run arbitrary gists[2] and this was before 2FA (FWIW you can still absolutely do this with npx).

I wrote a proof of concept[3] that showed you could, inside a package.json add a command to install another package from a gist location, and then use that to steal credentials, bash history, etc.

[1] https://github.com/tanepiper/npm-lint

I don't like makefiles, but I've been enjoying justfiles: https://github.com/casey/just

I started using just [0] on my projects and have been very happy so far. It is very similar to make but focused on commands rather than build outputs.

Define your recipes and then you can compose them as needed.

[0] https://github.com/casey/just

just - https://github.com/casey/just

Welp there is absolute chaos in that thread -- guess it's not an April Fools joke.

I wonder if relying on CI for anything other than provisioning machines is a mistake -- maybe we should have never moved from doing things from local scripts written in $LANGUAGE.

That said, I'm probably biased since I'm a massive fan of things like `make` and more appropriately for the current age, `just`[0]

[0]: https://github.com/casey/just

> When a command has some cognitive requirements I create a script with some ${1:-default} values and I store them all in $PATH enabled local/bin

I would consider using just for this:

https://github.com/casey/just

Your coworker's experience is more principled: Make is a mediocre tool for executing commands. It wasn't ever designed for that. Although it is pretty common to see what you are mentioning in projects because it doesn't require installing a dependency.

For a repo where an easy to install (single binary) dependency is a non-issue, consider using just. [1] You get `just -l` where you can see all the command available, the ability to use different languages, and overall simpler command writing.

[1] https://github.com/casey/just

This is fantastic, but I'd say that this solution is somewhat in response to this open issue from 2019:

https://github.com/casey/just/issues/429

I really wish just was included as a package in distributions.

So far, I didn't work on new features at all but on stabilizing the ground for further development: 1. CMake lists and modules were rewritten a lot, now managing builds and their configurations is much lesser pain. 2. Brought in Justfile for regular tasks, and it's great, no less. 3. Linters, formatters, analyzers for almost all the code (except for Janet for now, as because of it being a niche and young technology, it didn't get enough attention yet). 4. ECS stub. Now runtime class doesn't look like a god object. 5. Started writing unit tests which didn't happen with my personal projects before and maybe indicates how serious am I about this one :D 6. Some of previously hardcoded data has been moved to INI files. Now, if I release the game in 10 years, and in 10 more years some eccentric person decides to make a variant of it, it will be slightly simpler.

i've grown to like this for my personal projects. https://github.com/casey/just