Hacker News Reader

Full thread

ammo1662

How to avoid such kind of problems? node_modules is terrible.

I can only think of some ideas:

- Use a private registry, which will only sync with upstream once a month.

- Do not update dependencies frequently.

Any other ideas?

View on HN

specify specific versions in your npm or pip package list lol.

Even better, specify by hash - Poetry for Python does this by default. This will prevent cases where malicious actors replace existing versions that you might have pinned to.

Yes, package.lock is used by default now. But when you do want to update the dependencies. It will update thousands of libraries at the same time.

However it is a problem of the eco system, not package manager.

Reply on news.ycombinator.com