Hacker News Reader

I mostly write in languages without package managers so it is possible that my expectations are just wrong, but is there no way of showing your dependency graph when using npm?

View on HN

Here are some popular ones. Now, in two of these cases, they can be dev-dependencies, but even there, it makes me angry, since all of those deps have to be downloaded to my machine, and can run any random code they want at install time (which is why Node projects should always be run in some kind of sandbox).

https://npm.anvaka.com/#/view/2d/jest

https://npm.anvaka.com/#/view/2d/tailwind

https://npm.anvaka.com/#/view/2d/aws-sdk

> can run any random code they want at install time (which is why Node projects should always be run in some kind of sandbox).

You can install with the --ignore-scripts flag. Or set the option globally in your npm config file.

Reply on news.ycombinator.com