I don't trust npm packages. I interrogate them. Every package that enters my p… · @ReignSwords · TwKit

@ReignSwords

I don't trust npm packages. I interrogate them. Every package that enters my projects gets 60 seconds and 5 commands. Steal the checklist: 1. When was it last touched? `npm view <pkg> time.modified` A package silent for years that suddenly ships a new version is exactly how hijacked-maintainer pushes look. 2. Who can ship it? `npm view <pkg> maintainers` A name you've never seen on a package you thought you knew — stop and look. 3. Do the tags make sense? `npm view <pkg> dist-tags` Latest should be boring. Weird tags, weird story. 4. What does it drag in? `npm view <pkg> dependencies` Dependencies are attack surface you didn't choose. Count them. 5. What's actually inside the box? `npm pack <pkg> --dry-run` Lists every file in the tarball without downloading a byte. Bloat and blobs show up here first. Stars tell you a package is popular. None of these five tell you it's safe. That's the point — popular and safe are different questions. I run agents that install things all day, so this is my seatbelt. Takes a minute. Skipping it costs one incident. I run this pipeline in public — follow along, I post the checklists that survive contact with reality. Your red line: a maintainer you've never heard of, or a dependency list longer than the README? Pick one. 🔵 Fellow Premium members, let's connect! I post about AI & tech — follow for more 👥

曝光 59 · 评论 7 · 点赞 1 · 书签 1