Hacker News Reader

Comment by voidUpdate | Hacker News Reader

One thing I've never understood is why NPM allows packages to run code immediately after they are installed. What's the use case for that? A package should just be some code you can call on at runtime

View on HN

Some packages need to build native dependencies. sharp for example needs to build libvips on the system [0] to work

0: https://github.com/lovell/sharp/blob/main/install/build.js

I’ve always felt this automation shouldn’t exist at all, but should rather be selectively controlled via a hook. The hooks yarn offers out of the box for example can be used to run any code you need to after install. Putting the project owner in control instead of the dependency.

Nuget/.NET ecosystem just handles it so much better. Netvips assumes libvips is available and they provide packages for common platforms. No need to waste electricity rebuilding stuff, or install native build chains, build and test deps. Similar for Skia or Sqlite or whatever.

but how can you verify that the prebuilt binaries aren’t compromised?

Out of interest, do you verify that every single binary file on your machine isn't compromised? All the packages coming from your package manager?

I absolutely don't. I even sometimes use "curl | bash" to install new things on my machine because most of the time it's easy and I tend to trust the authors.

My point was just that I don't think moving to pre-built binaries solves this issue.

sharp downloads over https and checks the sha256 (I think?) of the archive.

sharp does this too:

https://sharp.pixelplumbing.com/install/#prebuilt-binaries

it can sometimes need to compile the C++ shim that sits between node and libvips, but that's rare.

sharp does not rebuild libvips, it downloads a pre-compiled libvips for your platform.

https://sharp.pixelplumbing.com/install/#prebuilt-binaries

It can usually also download a precompiled binary for the C++ shim that sits between node and libvips, but if your node / arch / etc. is not supported, it'll compile that (that's what the build.js file you linked does).

I turn off running scripts on installation. So far, no inconveniences.

Some packages with native code components (like sharp) will use these hooks to download the correct precompiled native binary for you.

Reply on news.ycombinator.com