npm-lint VS pnpm

That postinstall and other scripts have been a problem for a long time - the PoC for example could be installed via npx, which would then run postinstall which executes another script to steal /etc/password data.

This is not a new problem, you just have another vector.

I came up with a free linter package to try solve it - but no one seemed interested, and here we are 7 later talking about where people are now offering paid services to mitigate it.

https://github.com/tanepiper/npm-lint

Also ended up writing a similar tool but didn't take it much further.

I did try come up with a npm linter but never really completed it.

A while back I wrote a opt-in tool called npl-lint[1] that would allow some CI-level enforcement of rules in package.json although I didn't go too far with it - one thing was to check the scripts section and allow whitelisted apps, or whitelisted sources for dependencies.

It came about because I ended up having a spat with one of the NPM engineers at the time because they launched npx with the ability to run arbitrary gists[2] and this was before 2FA (FWIW you can still absolutely do this with npx).

I wrote a proof of concept[3] that showed you could, inside a package.json add a command to install another package from a gist location, and then use that to steal credentials, bash history, etc.

[1] https://github.com/tanepiper/npm-lint

pnpm

Pnpm for install Javascript/Typescript packages, like LangChain.js

Node.js manages dependencies using package managers like npm (Node Package Manager), yarn, and pnpm. npm comes pre-installed with Node.js and allows you to install and uninstall Node.js packages. It uses a package.json file to keep track of which packages your project depends on. Yarn and Pnpm are alternative package managers that aim to improve on npm in various ways, such as improved performance and better lock file format.

Use pnpm - This is just one recommendation, but it's too big of a topic to discuss here.

In this blog post, I explain how to use pnpm in GitLab CI and how to authenticate with a private GitLab package registry.

A package manager such as npm, Yarn, or pnpm. A package manager is a tool that helps you manage the dependencies of your project. You can use any of these package managers to install Jest and other packages.

Installation: Install Redux and React-Redux using npm or yarn.(you can try pnpm too!)

I also recommend using pnpm as a package manager, it's faster and more efficient than npm or yarn with great capabilities concerning monorepo setup. On recent nodejs versions (v16.13+), you can install it easily with: