5 ms·
It’s still ridiculous to me that version pinning isn’t the default for npm. The first thing I do for all of my projects is adding a .npmrc with save-exact=true
by AndreasHae 1y ago
It’s still ridiculous to me that version pinning isn’t the default for npm.
The first thing I do for all of my projects is adding a .npmrc with save-exact=true
- silverwind 1y agosave-exact is mostly useless against such attacks because it only works on direct dependencies.
- electrotype 1y agoWhy, though?