Hacker News Reader

crossenv was already running the script on post install, which means it was run on "npm i crossenv" anyway.

point is that npm are encouraging you to use npx, which is bundled with npm 5.2+ as a general tool for executing adhoc commands from the terminal. It just massively increases the chance of typos.

At some point there needs to be some trust, and NPM puts that boundary at installation. If you trust a package enough to install it, then it's allowed to act on your behalf with the permissions of your user.

`npx` doesn't change that dynamic. It's no different than installing an RPM or Debian package over the internet.

Imagine if Debian decided that `sduo rm *` meant it should apt-get install the sduo package and run immediately it.

I know my systrems system wouldn't last 5 minutes.

Reply on news.ycombinator.com