Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Safe-NPM – only install packages that are +90 days old

github.com

Post reply on HN
Print view View original

51–60 of 69 posts

Re: Show HN: Safe-NPM – only install packages that are +90 days old

#51

Post by moritzwarhier »

mort96 wrote: post #46
sebmellen wrote: post #20

"Here, install my new 1-day old NPM package that doesn't let you install packages younger than 90 days." Pardon me, I couldn’t help myself :D

I get that it's a joke, but I feel the need to defend this project anyway. The problem with NPM isn't any one young package. The problem with the NPM is that any time you run 'npm install', you download potentially thousands of packages, and you get the most recent patch release from all of them. Installing one 1-day-old NPM package to forever avoid day 1 releases of thousands of packages seems like a worthwhile trad…

> The problem with NPM isn't any one young package. The problem with the NPM is that any time you run 'npm install', you download potentially thousands of packages, and you get the most recent patch release from all of them.

Isn't this simply wrong?

Last I checked, lock files work. They didn't for a long time, until a couple of years ago, as far as I know.

If you delete your lock file or explicitly run a package upgrade, sure, you get the latest versions compatible with your semver ranges.

> Installing one 1-day-old NPM package to forever avoid day 1 releases of thousands of packages seems like a worthwhile trade.

If you want to be extra sure, you can simply not use semver ranges in your package.json, or only for select packages.

As far as I know, this is recommended anyway.

Re: Show HN: Safe-NPM – only install packages that are +90 days old

#52

Post by mort96 »

moritzwarhier wrote: post #51
mort96 wrote: post #46

Earlier quoted context omitted.

I get that it's a joke, but I feel the need to defend this project anyway. The problem with NPM isn't any one young package. The problem with the NPM is that any time you run 'npm install', you download potentially thousands of packages, and you get the most recent patch release from all of them. Installing one 1-day-old NPM package to forever avoid day 1 releases of thousands of packages seems like a worthwhile trad…

> The problem with NPM isn't any one young package. The problem with the NPM is that any time you run 'npm install', you download potentially thousands of packages, and you get the most recent patch release from all of them. Isn't this simply wrong? Last I checked, lock files work. They didn't for a long time, until a couple of years ago, as far as I know. If you delete your lock file or explicitly run a package upgr…

Doesn't NPM only respect lock files when you run 'npm ci'? I thought 'npm install' just used the constraints in package.json

Re: Show HN: Safe-NPM – only install packages that are +90 days old

#53

Post by moritzwarhier »

mort96 wrote: post #52
moritzwarhier wrote: post #51

Earlier quoted context omitted.

> The problem with NPM isn't any one young package. The problem with the NPM is that any time you run 'npm install', you download potentially thousands of packages, and you get the most recent patch release from all of them. Isn't this simply wrong? Last I checked, lock files work. They didn't for a long time, until a couple of years ago, as far as I know. If you delete your lock file or explicitly run a package upgr…

Doesn't NPM only respect lock files when you run 'npm ci'? I thought 'npm install' just used the constraints in package.json

You are right that 'npm install' can upgrade versions even when a lock file is present, but AFAIK this should only happen it the lock file is not compatible with the package.json. I haven't seen it in a long time, and AFAIK it can't happen without you changing the package.json.

But yes, it's a reason to pin dependencies and use npm ci / yarn immutable etc.

Updates of transitive dependencies are afaik not automatically installed when there is a working lock file: this is the thing that changed some versions ago I think (I mixed up Node and npm versions in my initial comment).

So yes, to be sure that you never install anything else, it's best to use 'npm ci' or 'yarn install --immutable', which will fail if the lock file is broken or not present.

But 'npm install' does not install the latest patch release compatible with your package.json with precedence over the lockfile.

What it does do is upgrade if you edit the version range by hand to be incompatible with the lock file, e.g. increase major version of a package.

But if you have, say, Typescript ^5 in your package.json, but 5.4 in your lock file, 'npm install' won't upgrade it.

https://docs.npmjs.com/cli/v11/commands/npm-install

> If the package has a package-lock, or an npm shrinkwrap file, or a yarn lock file, the installation of dependencies will be driven by that, respecting the following order of precedence:

> npm-shrinkwrap.json

> package-lock.json

> yarn.lock

'npm ci' and friends are safer as they will always fail when they can't install from lock file without any conflicts or changes, that's correct.

Don't know how other package managers behave in this regard, except for yarn and pnpm.

PHP composer AFAIK behaves similar to npm?

Re: Show HN: Safe-NPM – only install packages that are +90 days old

#54

Post by moritzwarhier »

m4rtink wrote: post #49
moritzwarhier wrote: post #29

Earlier quoted context omitted.

What would be a better solution? Do other package managers reliably restrict access to the host system beyond the scope of the project folder? Many quirks come from abilities that were once deemed useful, such as compiling code in other languages after package install. Sure, today, I can disable install scripts if I want but it doesn't change much when I eventually run code from the package anyway. But even restricti…

Established Linux distributions.

Sure. But I'm not sure if I wanted to burden their package registry maintainers with maintaining all kinds of JS/TS packages?

And if you go for custom registries, what's the big difference to npm registry?

I don't understand it :)

One good thing about npm ecosystem IMO is that it's frowned upon to depend on system globals.

Re: Show HN: Safe-NPM – only install packages that are +90 days old

#57

Post by c-hendricks »

ghtbircshotbe wrote: post #55
m4rtink wrote: post #48

So how is not using those Debian packages because they are too old working out ? ;-)

Recently decided to learn typescript. You would hardly know there's a Debian package from reading typescript's website.

Why would the typescript webpage mention Debian at all?

Re: Show HN: Safe-NPM – only install packages that are +90 days old

#58

Post by vrighter »

the more people use this, the less useful it becomes for everyone. If everyone uses this, then everyone would still be using a particular package for the first time at the same time. What then? Release another package that extends the delay to 6 months?

Re: Show HN: Safe-NPM – only install packages that are +90 days old

#59

Post by mdx97 »

vrighter wrote: post #58

the more people use this, the less useful it becomes for everyone. If everyone uses this, then everyone would still be using a particular package for the first time at the same time. What then? Release another package that extends the delay to 6 months?

Malicious packages aren’t just found because someone gets pwned, there are organizations out there proactively scanning for this stuff.

Re: Show HN: Safe-NPM – only install packages that are +90 days old

#60

Post by ghtbircshotbe »

c-hendricks wrote: post #57
ghtbircshotbe wrote: post #55

Earlier quoted context omitted.

Recently decided to learn typescript. You would hardly know there's a Debian package from reading typescript's website.

Why would the typescript webpage mention Debian at all?

In telling you how to install it. That's kind of the point - they all assume you're going to use npm to install it.
Post reply on HN