Hacker GitHub

← All repos

npm/rfcs

View on GitHub ↗ ★ 780 JavaScript

Public change requests/proposals & ideation

26 mentions on Hacker News by 23 people: 5 stories, 21 comments · first 2018-07-14 · latest 2026-07-15

Mentions per year 26 mentions · busiest year 2021 (8)
20082026
AllStoriesComments NewestTopOldest
  1. …a per-dependency opt in mechanism [2]. [1] https://github.com/npm/cli/releases/tag/v11.16.0 [2] https://github.com/npm/rfcs/pull/868
    comment by bakkoting · 2026-06-01 · in Malicious npm packages detected across Red Hat Cloud Services
  2. …eventually going to be the default behavior. Late is worse (edit: I meant better) than not at all. https://github.com/npm/rfcs/pull/868
    comment by semiquaver · 2026-06-01 · in Malicious npm packages detected across Red Hat Cloud Services
  3. There's an RFC for this: https://github.com/npm/rfcs/pull/868
    comment by bakkoting · 2026-05-19 · in Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
  4. …became common then it would just delay discovery of vulnerabilities until after that time anyways" https://github.com/npm/rfcs/issues/646#issuecomment-12824971...
    comment by JoshuaEN · 2025-09-18 · in Pnpm has a new setting to stave off supply chain attacks
  5. …apparently an npm RFC from 2022 proposing a similar (but potentially slightly better?) solution https://github.com/npm/rfcs/issues/646
    comment by brw · 2025-09-16 · in Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
  6. …archive in about 1.2 seconds on my machine. Zopfli, with just 1 iteration, took 2.5 minutes. [1] https://github.com/npm/rfcs/pull/595#issuecomment-1200480148 My question of course would be, what about LZ4, or Zstd or Brotli? Or is…
    comment by bangaladore · 2025-01-27 · in My failed attempt to shrink all NPM packages by 5%
  7. …of these options add complexity. Wow! Who's going to tell them that V8 is written in C++? :) [1]: https://github.com/npm/rfcs/pull/595
    comment by woadwarrior01 · 2025-01-27 · in My failed attempt to shrink all NPM packages by 5%
  8. The final pro/cons list: https://github.com/npm/rfcs/pull/595#issuecomment-1200480148 I don't find the cons all that compelling to be honest, or at least I think they warrant further discussion to see if there are workarounds (e.g. a…
    comment by sd9 · 2025-01-27 · in My failed attempt to shrink all NPM packages by 5%
  9. …ignore/acknowledge specific entries. `npm audit` is not an end-all-be-all. Like and subscribe[0]: https://github.com/npm/rfcs/pull/18 https://www.npmjs.com/package/npm-audit-resolver [0]: The bottom comment from Jan sums up what happens…
    comment by 3np · 2024-08-07 · in 70% of new NPM packages in last 6 months were spam
  10. …comprehensive than Lerna. I agree that this should be built into npm. There's an RRFC for it here: https://github.com/npm/rfcs/issues/706
    comment by spankalee · 2023-10-23 · in Yarn 4.0
  11. I believe the RFC for just that has landed: https://github.com/npm/rfcs/blob/main/accepted/0042-isolated... Yarn has a PNPM mode now too: https://dev.to/arcanis/yarn-31-corepack-esm-pnpm-optional-pa...
    comment by no_wizard · 2022-04-05 · in pnpm: Fast, disk space efficient package manager for JavaScript
  12. …to package/deploy, because of course you may expand your usage of their APIs during development. 1: https://github.com/npm/rfcs/pull/422
    comment by eyelidlessness · 2022-03-25 · in On node-ipc and the importance of trusting trust
  13. https://github.com/npm/rfcs/issues/509 it more or less just makes it difficult for updates to propogate, which is arguably a good thing.
    comment by zkldi · 2022-03-19 · in On the Weaponisation of Open Source
  14. …examples are so rare, though, that there is an active proposal to make this option the default. https://github.com/npm/rfcs/pull/488
    comment by dane-pgp · 2021-11-17 · in Security issue related to the NPM registry
  15. Re https://github.com/npm/rfcs/pull/488 . Thank you for your service! I had this on my TODO for months. Actually I just use yarn now where ever possible and set `enableScripts: false` both globally and per package. Doesn't solve all of the…
    comment by theteapot · 2021-11-09 · in $ sudo rm -rf / === NPM install
  16. Ah, looks like it was introduced in v7.0 - https://github.com/npm/rfcs/pull/185
    comment by jffry · 2021-11-06 · in Embedded malware in RC (NPM package)
  17. If you're interested in preventing this sort of thing, I'd appreciate comments on this [RFC]( https://github.com/npm/rfcs/pull/488 ) I just submitted to npm to make install scripts opt-in instead of default behavior . While of course not…
    comment by tolmasky · 2021-11-05 · in Embedded malware in RC (NPM package)
  18. > explicitly mark which packages can run postinstall scripts Here's an RFC on exactly that: https://github.com/npm/rfcs/discussions/80
    comment by dustyharddrive · 2021-11-05 · in Embedded Malware in Coa
  19. …serious security issues—but I think folks here might be interested in it given this compromise. 1: https://github.com/npm/rfcs/pull/422
    comment by eyelidlessness · 2021-10-23 · in NPM package ‘ua-parser-JS’ with more than 7M weekly download is compromised
  20. There's some ongoing work to improve this, by reducing noise & false positives: https://github.com/npm/rfcs/pull/422
    comment by pimterry · 2021-08-12 · in NodeJS security cheat sheet
  21. RFC: https://github.com/npm/rfcs/pull/16/files?short_path=5c765e6 Summarized algorithm: https://cdn-images-1.medium.com/max/800/1*1b7KHDG2St5D-6jepf...
    comment by dbkaplun · 2018-07-14 · in Secure, reproducible builds for NPM