Item — HN Reader

No other package manager is worse than NPM. Outside of its 'popularity', there are several fundamental reasons why this continues to happen to NPM:

- Imported packages are not pinned by default.

- Typescript / Javascript's lack of a standard library encourages the developer to import more packages into their codebase to address the short-comings which increases the risk of importing a bad package.

- Post install scripts execute external code by default upon downloading dependencies.

All of this comes by default in the ecosystem and we continue to see more shai-hulud worms all easily targeting NPM. Not even signed packages are enforced by default either.

3 comments

> Imported packages are not pinned by default

What do you mean? The lockfile of all package managers is there for pinning the exact versions. For yarn and pnpm, installs on CI run automatically from lockfile only, for npm I think you still need to run `npm ci` instead of `npm install`. But this guarantees that no new versions get pulled automatically in by CI.

> Typescript / Javascript's lack of a standard library

That's true, but it's not an issue of the package manager / registry

> Post install scripts execute external code by default upon downloading dependencies.

They are disabled by default in all package managers now, the user needs to manually allow them

Two out of three of your points - the first and last - are just incorrect.

Ruby is worse. crates.io is arguably worse.