Hacker GitHub

← All repos

npm/cli

View on GitHub ↗ ★ 10,235 JavaScript

the package manager for JavaScript

59 mentions on Hacker News by 55 people: 17 stories, 42 comments · first 2018-12-03 · latest 2026-10-12

Mentions per year 59 mentions · busiest year 2025 (12)
20082026
AllStoriesComments NewestTopOldest
  1. …Node 27 will likely ship with it: https://github.com/nodejs/Release/issues/1161 https://github.com/npm/cli/issues/9997
    comment by nicce · 2026-10-12 · in Zod 4.6.6 compromised by malware?
  2. There is some effort to make NPM more secure https://github.com/npm/cli/pull/9360 .
    comment by zeraye · 2026-06-01 · in Malicious npm packages detected across Red Hat Cloud Services
  3. …will be disabled by default in a future version, with a per-dependency opt in mechanism [2]. [1] https://github.com/npm/cli/releases/tag/v11.16.0 [2] https://github.com/npm/rfcs/pull/868
    comment by bakkoting · 2026-06-01 · in Malicious npm packages detected across Red Hat Cloud Services
  4. …vintage, protecting you from all these supply chain attacks as they tend to be quickly detected. https://github.com/npm/cli/releases/tag/v11.10.0
    comment by JulienBrouchier · 2026-05-08 · in Maybe you shouldn't install new software for a bit
  5. …see it anywhere in the NPM documentation. [0] https://news.ycombinator.com/item?id=47513932 [1] https://github.com/npm/cli/issues/8570 [2] https://socket.dev/blog/npm-introduces-minimumreleaseage-and...
    comment by backwardsponcho · 2026-05-08 · in Maybe you shouldn't install new software for a bit
  6. …you need to be on npm >= 11.10.0 in order to use it. It just became available Feb 11 2026 https://github.com/npm/cli/releases/tag/v11.10.0
    comment by flanbiscuit · 2026-03-31 · in Axios compromised on NPM – Malicious versions drop remote access trojan
  7. …age in February of this year , and still doesn't support package exclusions for internal packages. https://github.com/npm/cli/pull/8965 https://github.com/npm/cli/issues/8994 Its good that that they finally got there but.... I would be…
    comment by Tazerenix · 2026-03-31 · in Axios compromised on NPM – Malicious versions drop remote access trojan
  8. …* the case in point: https://github.com/gitcommitshow/resilient-llm/issues/39 * Docs issue : https://github.com/npm/cli/issues/8884 * The bug : https://github.com/npm/cli/issues/8730
    comment by witnessme · 2026-01-04 · in From fear to pain: NPM trusted publishing and oidc
  9. …marketing. Related to that is the proposal for `stabilityDays`, which seems way more practical: https://github.com/npm/cli/issues/8570#issuecomment-33004136... . So rather than merely saying "I only want package versions more than N days…
    comment by buu700 · 2025-11-27 · in Show HN: Safe-NPM – only install packages that are +90 days old
  10. …take quite a bit of time, even when all the packages are being served from the npm disk cache: https://github.com/npm/cli/issues/564
    comment by Mattwmaster58 · 2025-09-18 · in Pnpm has a new setting to stave off supply chain attacks
  11. …the entire node_modules directory. Lots of people have complained but they have done nothing: https://github.com/npm/cli/issues/564 The npm team eventually seemed to settle on requiring someone to bring an RFC for this improvment, and the…
    comment by Mattwmaster58 · 2025-09-08 · in NPM debug and chalk packages compromised
  12. …ps://github.com/npm/npm/pull/4016#issuecomment-76316744 https://news.ycombinator.com/item?id=38645969 https://github.com/npm/cli/commit/5a3b345d6d5d175ea9ec967364...
    comment by parliament32 · 2025-09-08 · in NPM debug and chalk packages compromised
  13. …is very, very buggy, and some of those bugs impact pulling deps from git repos. See my issue here: https://github.com/npm/cli/issues/8440 Here's the history behind that: Projects with build steps were silently broken as late as 2020:…
    comment by cstrahan · 2025-09-08 · in NPM debug and chalk packages compromised
  14. https://docs.npmjs.com/cli/v6/using-npm/config#update-notifi... https://github.com/npm/cli/blob/5d82d0b4a4bd1424031fb68b4df7...
    comment by jrasm91 · 2025-08-08 · in Cursed Knowledge
  15. …this, which I can confirm at least anecdotally from me trying to fix this issue myself. [1] https://github.com/npm/cli/issues/4232 [2] https://www.npmjs.com/package/stylus
    comment by sensanaty · 2025-07-23 · in NPM stylus package contained malicious code and was removed from the registry
  16. Slightly more info here: https://github.com/npm/cli/issues/8203
    comment by cbovis · 2025-04-01 · in NPM blocking all packages with the word "camel"
  17. …| https://registry.npmjs.org/camel123 | https://registry.yarnpkg.com/camel456 Some discussion here https://github.com/npm/cli/issues/8203 Edit: this is resolved now https://status.npmjs.org/incidents/hdtkrsqp134s
    comment by Recursing · 2025-04-01 · in Tell HN: Camelgate NPM Outage (Cloudflare)
  18. …without a README file because apparently someone somewhere is "opinionated" about symlinks. https://github.com/npm/cli/issues/6746 That was embarrassing and annoying. So I unpublished it. Then I discovered I couldn't replace the bad…
    comment by matheusmoreira · 2024-01-05 · in 'everything' blocks devs from removing their own NPM packages
  19. …[0][1] when installing packages, and then also not complaining at any other time in the future. [0] https://github.com/npm/cli/issues/4460 [1] https://github.com/npm/cli/issues/4263
    comment by rkeene2 · 2023-12-14 · in Ledger's NPM account has been hacked
  20. …[1] - https://github.com/motdotla/dotenv/blob/master/package-lock.... [2] - https://github.com/npm/cli/blob/latest/package-lock.json [3] - https://github.com/nodejs/readable-stream/
    comment by ramones13 · 2023-02-15 · in The case for frameworks
  21. …the Node Package Manager? Last release was a few hours ago according to the github release page https://github.com/npm/cli/releases/tag/v8.14.0
    comment by icermann · 2022-07-13 · in _hyperscript – a small scripting language for the web
  22. Npm 7+ can read and write yarn.lock https://github.com/npm/cli/blob/latest/workspaces/arborist/l...
    comment by seniorsassycat · 2022-07-06 · in Bun: Fast JavaScript runtime, transpiler, and NPM client written in Zig
  23. …but I invite you to look at some of the 2010-era code and blog posts to judge for yourself: https://github.com/npm/cli/tree/e790c85a https://blog.izs.me/2010/11/10-cool-things-you-probably-didn... You can read and/or listen to issacs talk…
    comment by sgentle · 2022-04-12 · in Node.js packages don't deserve trust
  24. See also https://github.com/npm/cli/issues/2701 I think this is quite a serious issue which has been open for almost a year. I don't understand why there hasn't been a reaction from the npm developers on the issue (as far as I can see).…
    comment by heijmans · 2022-01-19 · in NPM ci is currently broken
  25. …I'm kind of living in a different world when people say that lockfiles just solve everything. [0]: https://github.com/npm/cli/issues/564#issuecomment-921314014
    comment by danShumway · 2021-12-12 · in We check our node_modules folder into source control
  26. …the lockfile reliable across systems and versions. Here's an example from March that isn't fixed: https://github.com/npm/cli/issues/2846 The fact that you have so many people believing "nuke node_modules and delete package-lock.json" is a…
    comment by d3ad1ysp0rk · 2021-12-12 · in We check our node_modules folder into source control
  27. Or if the Easter egg was obfuscated and looked potentially malicious[1]. 1: https://github.com/npm/cli/issues/4091
    comment by dairylee · 2021-12-06 · in No Easter Eggs in Curl
  28. I stand corrected, thanks! Elegance in simplicity https://github.com/npm/cli/pull/202/files#diff-2a8ed1f0d31e4...
    comment by Floegipoky · 2021-10-08 · in GitHub Advisory Database now powers NPM audit
  29. …having no private registries configured. Still no fixes for this bug after multiples months: - https://github.com/npm/cli/issues/2799 - https://github.com/npm/cli/issues/3284 - There is a lot of other issues on this. Before this, whe had…
    comment by Kuinox · 2021-07-30 · in Yarn 3.0
  30. …around to implementing that functionality. If you want it changed, I suggest posting an issue https://github.com/npm/cli/issues . There's some question as to whether to prioritize the virtual tree or the actual tree, since prioritizing the…
    comment by IsaacSchlueter · 2021-07-14 · in Npm Audit: broken by design?
  31. …will happen in the latest attempt from an affected user? Tune in and be ready for an exciting ride! https://github.com/npm/cli/issues/2372 Spoiler: bugs are not sentient beings that solve themselves just by closing the issue (or the whole…
    comment by j1elo · 2021-07-07 · in Npm Audit: broken by design?
  32. …in the last few beta and release candidate releases and it just wasn't stable enough for me. https://github.com/npm/cli/issues/1984
    comment by Sheepsteak · 2020-10-23 · in Node.js 15.0
  33. > Npm could easily be an open source client The NPM client is and has always been open source: https://github.com/npm/cli . > Npm wanted to control nodejs and make money out it. And they have. In what way, other than offering private…
    comment by paavohtl · 2020-03-17 · in NPM Is Joining GitHub
  34. It's on there already. https://github.com/npm/ and https://github.com/npm/cli
    comment by zozbot234 · 2020-03-16 · in NPM Is Joining GitHub
  35. …like Verdaccio[5]. More ideas in this Twitter thread[6]. [1] https://nodeweekly.com/issues/326 [2] https://github.com/npm/cli/issues/836 [3] https://github.com/npm/cli/issues/836#issuecomment-587019096 [4] https://open-registry.dev/ [5]…
    comment by nilsandrey · 2020-02-22 · in Caching and Proxying the Fetching of Dependencies
  36. …changes of this nature so that we can discover impact sooner and roll back automatically. [0] https://github.com/npm/cli/issues/836#issuecomment-587019096
    comment by nonbirithm · 2020-02-17 · in NPM: 429 Too Many Requests
  37. Here's a postmortem comment from a Cloudflare engineer: https://github.com/npm/cli/issues/836#issuecomment-587019096
    comment by zovin · 2020-02-17 · in NPM: 429 Too Many Requests
  38. It's disappointing. I commented saying as such - https://github.com/npm/cli/issues/836#issuecomment-586990343 > Posting memes/jokes in an issue wastes the time of people who actually need to be able to read through the issue. > Stop it.…
    comment by ccmcarey · 2020-02-17 · in NPM: 429 Too Many Requests
  39. Yet the status page shows no errors. GitHub has a lot of reports tho: https://github.com/npm/cli/issues/836
    comment by moltar · 2020-02-17 · in NPM Is Down ("429 Too Many Requests")
  40. …npm code but it seems that they are indeed using git from the CLI instead using it via a library: https://github.com/npm/cli/blob/ba7f1466436cc22e27f8a14dede3...
    comment by est31 · 2020-01-15 · in Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
  41. …from withing package.json. 0: https://hub.packtpub.com/surprise-npm-layoffs-raise-question... 1: https://github.com/npm/cli/pull/125#issuecomment-474127391
    comment by judge2020 · 2019-08-21 · in The GitHub registry public beta is live
  42. npm itself has more dependencies. https://github.com/npm/cli/blob/latest/package.json
    comment by partycoder · 2018-12-03 · in Terminals Are Sexy