ultra-runner VS npm-lint

Cache built files to avoid rebuilds. For example nx.js, yarn-plugin-change, ultra-runner

Then comes the question of triggering docker builds if you need to release images. If you have many apps, it's better to create a docker file for each, so you can decide which one needs to be built. Nx help in this area, because it can compute which apps needs to be rebuilt... If you have only few apps you can use github action paths (ie: simplified example) or eventually make use of things like [ultra-runner](https://github.com/folke/ultra-runner). Anyway docker and nextjs take times to setup (env...). It's another story.

ultra-runner: scripts for JavaScripts monorepo management. Plugs in with Yarn, pnpm, and Lerna. Supports parallel building.

🏃 ultra-runner

That postinstall and other scripts have been a problem for a long time - the PoC for example could be installed via npx, which would then run postinstall which executes another script to steal /etc/password data.

This is not a new problem, you just have another vector.

I came up with a free linter package to try solve it - but no one seemed interested, and here we are 7 later talking about where people are now offering paid services to mitigate it.

https://github.com/tanepiper/npm-lint

Also ended up writing a similar tool but didn't take it much further.

I did try come up with a npm linter but never really completed it.

A while back I wrote a opt-in tool called npl-lint[1] that would allow some CI-level enforcement of rules in package.json although I didn't go too far with it - one thing was to check the scripts section and allow whitelisted apps, or whitelisted sources for dependencies.

It came about because I ended up having a spat with one of the NPM engineers at the time because they launched npx with the ability to run arbitrary gists[2] and this was before 2FA (FWIW you can still absolutely do this with npx).

I wrote a proof of concept[3] that showed you could, inside a package.json add a command to install another package from a gist location, and then use that to steal credentials, bash history, etc.

[1] https://github.com/tanepiper/npm-lint