he/him 
If you had to install an npm package by URL, instead of by registry name, would you mind? eg. $ npm install https://website.com/package.tgz $ yarn add https://website.com/package.tgz
Show this thread
-
This Tweet is unavailable.
-
The lock files already have SHA baked im so that wouldn't be a problem
It wouldn’t be a problem after first-install, but you’re trusting the registry to give you a safe hash in the beginning. Vulnerable to MitM, malicious insider etc.
-
-
There is always trust when you download third party libraries, and extensions. Even in NPM/Yarn today. How do you plan to circumvent that? Maybe tarballs and zipfiles are incorrect, Denojs allows the dev to link to the source directly, as a dev you need to analyze.
-
Or make use of the ever so popular blockchain to contain all the hashes of version updates, that way it can be decentralized
- 2 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.