he/him 
If you had to install an npm package by URL, instead of by registry name, would you mind? eg. $ npm install https://website.com/package.tgz $ yarn add https://website.com/package.tgz
Show this thread
-
Self-provided integrity hashes seems like a security con rather than pro, cause like, where are they gonna get the hash from? Some website, which is just as easy (probably easier!) to takeover/spoof as the download URL itself
I guess that’s true. But now if you had write access to where the installation instructions were you could just change the package name to something else. I wouldn’t consider that any better.