Really ads in a terminal is a needless attack vector that is a dumpster fire for security that is part of the reason /why/ they have so many detractors.
Reading the code of the NPM package will not typically help with understanding what it's going to do, because of the ad ecosystem, which guarantees running code you have never seen.
I could understand banning dynamic ad injection and telemetry. My ethical line would be if a package manager were to ban static links/symbols displayed in a README and that's not what NPM aims for, so it's fine by me.
Can you point out a real example of terminal advertising like this?
I could make it without any effort via:
> https://github.com/feross/funding/blob/master/messages.json
Currently it's "manually curated" which is a fancy way of saying, it's my own custom ad-tag that doesn't call an adserver. Replacing one field with a function that is immediately called and getting your value out, is how most people would integrate an ad-tag.
Using DFP or whatever, you can plug in an adtag call and parse values and you're in business. Ad platforms don't usually support plaintext tags, but I have seen them still supported by some of the older "native ad" platforms who started as platforms that served HTML strings (Taboola, etc).
The takeaway is that NPM nipped it in the bud because it's trivial to abuse.
This seems like a silly slippery slope argument.
It exists on my computer right now (didn't use an actual admanager, just coded a remote call). You want to believe the gun pointed at the door with a string on the trigger and doorknob is not a danger because you don't want to open the door. Good luck with whatever.
It is possible they had learned from mistakes of the past and have proper output and input segregation to prevent such shenanigans entirely. In which case that would still leave social engineering as an attack surface. "Use X for your product - except X is ransomware or harvests sensitive data."
You’re running their code, whether it prints an ad or not. There’s no need for “injection attacks and escape sequences” at that point.
But now they're hosting the ads and potentially allowing remote code execution. Now the attacker only needs to get on to a webserver to deploy a payload. That's why it opens a new vector of attack.
Moreover, if they're able to own the server quietly, they can be deploying whatever they like to a ton of people over time.
They’ve looked like echo “Hi please send me money”