{"slug": "npm", "name": "npm", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 2, "commenters": 18, "warners": 14, "score": -10.258, "rising": 0.67, "first": "2025-12-22", "latest": "2026-10-31", "why": "Fortunately npm v12+ disables lifecycle scripts by default.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 2, "neutral": 2, "compare": 0, "warn": 14}, "spark": [0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1], "listed": false, "loved": [], "caveat": "", "short_quote": "Fortunately npm v12+ disables lifecycle scripts by default.", "icon": false, "domain": null, "github_repo": null, "official_url": "", "pricing": "", "aliases": ["npm"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 799782401, "item_id": 49986400, "url": "https://news.ycombinator.com/item?id=49986400", "by": "miiiiiike", "date": "2026-10-07", "stance": "recommend", "quote": "Fortunately npm v12+ disables lifecycle scripts by default.", "excerpt": "pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently, for many reasons. Fortunately npm v12+ disables lifecycle scripts by default.", "context": "", "use_case": "", "switched_from": "pnpm", "story": "Friendship ended with Deno, now Node is my best friend"}, {"id": 765958481, "item_id": 47872405, "url": "https://news.ycombinator.com/item?id=47872405", "by": "HiPhish", "date": "2026-04-22", "stance": "recommend", "quote": "but it gets the job done", "excerpt": "> written in Lisp (Guile Scheme) Doomed to obscurity. Look, I love Lisp like any other Lisper, but there is no proper Guile (let alone general Scheme) package manager, which means any Guile project will be be an uphill battle to maintain dependencies in. Oh well, at least it has a code of conduct, that has to count for something I guess? The fact of the matter is that there is just too much good stuff for the fronten", "context": "", "use_case": "frontend dependencies and tooling", "switched_from": "", "story": "Olive CSS: Lisp powered vanilla CSS utility-Class A la Tailwind"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 800563714, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "warn", "quote": "I never trust npm, pypi, etc. any longer.", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 798905874, "item_id": 49931617, "url": "https://news.ycombinator.com/item?id=49931617", "by": "weitendorf", "date": "2026-10-02", "stance": "warn", "quote": "the benefits of having no npm and related ecosystem tools and no dependencies", "excerpt": "I strongly recommend vanilla html, js, and css. For me the benefits of having no npm and related ecosystem tools and no dependencies far outweigh any benefits you get from switching to specific framework. It took me just as long to learn modern css, html, and basically all the browser APIs as it did to learn how to setup+build+modify+deploy my svelte-vscodeextension-webview project without getting bogged down in the ", "context": "", "use_case": "", "switched_from": "", "story": "SvelteKit 3"}, {"id": 797939745, "item_id": 49871234, "url": "https://news.ycombinator.com/item?id=49871234", "by": "Bowes-Lyon", "date": "2026-09-27", "stance": "warn", "quote": "The JavaScript ecosystem is a dumpster fire within a miasma-infested cloaca.", "excerpt": "This. The JavaScript ecosystem is a dumpster fire within a miasma-infested cloaca. I love Pi, but I hate that I have to deal with the npm garbage. Every time I run \"pi update --extensions\" I get this: added 1 package, removed 1 package, changed 8 packages, and audited 320 packages in 6s 4 vulnerabilities (2 moderate, 2 high) For the love of god I still haven't been able to fix those ominous 4 vulnerabilities. I even ", "context": "", "use_case": "installing Pi extensions", "switched_from": "", "story": "Pig: Pi in Go, a port that plans on keeping up"}, {"id": 791378416, "item_id": 49461151, "url": "https://news.ycombinator.com/item?id=49461151", "by": "CraigJPerry", "date": "2026-08-27", "stance": "warn", "quote": "Given its security model, i think spicy is a far more apt label.", "excerpt": "Describing NPM as boring is a stretch. Given its security model, i think spicy is a far more apt label. I have switched to pnpm already.", "context": "", "use_case": "Node package manager", "switched_from": "", "story": "Pnpm 12.0"}]}], "who": [], "tags": [], "use_cases": ["package management", "package update cooldown", "installing pi extensions", "node package manager", "package registry", "frontend dependencies and tooling"], "compared": [{"slug": "pnpm", "name": "pnpm", "co": 3, "switched_from": 1, "switched_to": 1}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50316531", "title": "Malware uses LLMs to rank victims by how much they're worth", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50029123", "title": "Telegram Desktop vulnerability allowed any user's file to be stolen", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49971719", "title": "Friendship ended with Deno, now Node is my best friend", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49926536", "title": "SvelteKit 3", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49866296", "title": "Pig: Pi in Go, a port that plans on keeping up", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49460032", "title": "Pnpm 12.0", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"warn": 1}, "2026-01": {"warn": 3}, "2026-02": {}, "2026-03": {}, "2026-04": {"recommend": 1}, "2026-05": {"warn": 1}, "2026-06": {"warn": 5, "neutral": 1}, "2026-07": {}, "2026-08": {"warn": 1}, "2026-09": {"warn": 1}, "2026-10": {"warn": 2, "recommend": 1, "neutral": 1}}, "quotes": [{"id": 805090720, "item_id": 50318170, "url": "https://news.ycombinator.com/item?id=50318170", "by": "hangrybear666", "date": "2026-10-31", "stance": "neutral", "quote": "I use min-release-age =14 for npm now as a default", "excerpt": "Do package managers for Linux distros have this, like dnf/yum/apt/pacman? I use min-release-age =14 for npm now as a default but should start using it everywhere it's possible", "context": "", "use_case": "package update cooldown", "switched_from": "", "story": "Malware uses LLMs to rank victims by how much they're worth"}, {"id": 800563714, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "warn", "quote": "I never trust npm, pypi, etc. any longer.", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 799782401, "item_id": 49986400, "url": "https://news.ycombinator.com/item?id=49986400", "by": "miiiiiike", "date": "2026-10-07", "stance": "recommend", "quote": "Fortunately npm v12+ disables lifecycle scripts by default.", "excerpt": "pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently, for many reasons. Fortunately npm v12+ disables lifecycle scripts by default.", "context": "", "use_case": "", "switched_from": "pnpm", "story": "Friendship ended with Deno, now Node is my best friend"}, {"id": 798905874, "item_id": 49931617, "url": "https://news.ycombinator.com/item?id=49931617", "by": "weitendorf", "date": "2026-10-02", "stance": "warn", "quote": "the benefits of having no npm and related ecosystem tools and no dependencies", "excerpt": "I strongly recommend vanilla html, js, and css. For me the benefits of having no npm and related ecosystem tools and no dependencies far outweigh any benefits you get from switching to specific framework. It took me just as long to learn modern css, html, and basically all the browser APIs as it did to learn how to setup+build+modify+deploy my svelte-vscodeextension-webview project without getting bogged down in the ", "context": "", "use_case": "", "switched_from": "", "story": "SvelteKit 3"}, {"id": 797939745, "item_id": 49871234, "url": "https://news.ycombinator.com/item?id=49871234", "by": "Bowes-Lyon", "date": "2026-09-27", "stance": "warn", "quote": "The JavaScript ecosystem is a dumpster fire within a miasma-infested cloaca.", "excerpt": "This. The JavaScript ecosystem is a dumpster fire within a miasma-infested cloaca. I love Pi, but I hate that I have to deal with the npm garbage. Every time I run \"pi update --extensions\" I get this: added 1 package, removed 1 package, changed 8 packages, and audited 320 packages in 6s 4 vulnerabilities (2 moderate, 2 high) For the love of god I still haven't been able to fix those ominous 4 vulnerabilities. I even ", "context": "", "use_case": "installing Pi extensions", "switched_from": "", "story": "Pig: Pi in Go, a port that plans on keeping up"}, {"id": 791378416, "item_id": 49461151, "url": "https://news.ycombinator.com/item?id=49461151", "by": "CraigJPerry", "date": "2026-08-27", "stance": "warn", "quote": "Given its security model, i think spicy is a far more apt label.", "excerpt": "Describing NPM as boring is a stretch. Given its security model, i think spicy is a far more apt label. I have switched to pnpm already.", "context": "", "use_case": "Node package manager", "switched_from": "", "story": "Pnpm 12.0"}, {"id": 777692592, "item_id": 48605787, "url": "https://news.ycombinator.com/item?id=48605787", "by": "cozzyd", "date": "2026-06-19", "stance": "warn", "quote": "I love the smell of npm install malware in the morning.", "excerpt": "I love the smell of npm install malware in the morning.", "context": "", "use_case": "", "switched_from": "", "story": "AURpocalypse now: a look at the recent AUR attacks"}, {"id": 776292240, "item_id": 48518265, "url": "https://news.ycombinator.com/item?id=48518265", "by": "stefan_", "date": "2026-06-13", "stance": "warn", "quote": "the malware is still distributed through NPM. Legendary platform.", "excerpt": "I love that even when trying to put malware into Arch Linux AUR, the malware is still distributed through NPM. Legendary platform.", "context": "", "use_case": "", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 776043091, "item_id": 48502693, "url": "https://news.ycombinator.com/item?id=48502693", "by": "sph", "date": "2026-06-12", "stance": "warn", "quote": "for the love of God don't touch anything that uses npm", "excerpt": "Be aware of false positives! I found I had two of these packages installed, clang19 and compiler-rt19, but due to my recent laziness in updating my system, mine were still the versions from July 2025 from the official repos before they had relegated them to AUR. You can check the build and install date with `pacman -Qi <package>`. I run Arch Linux in a container (within Fedora Silverblue), but my plan for the future:", "context": "", "use_case": "", "switched_from": "", "story": "AUR Packages Compromised with Infostealer and Rootkit"}, {"id": 776014752, "item_id": 48500922, "url": "https://news.ycombinator.com/item?id=48500922", "by": "TiredOfLife", "date": "2026-06-12", "stance": "neutral", "quote": "I use npm 11.16.0", "excerpt": "I use npm 11.16.0 and it did this npm warn allow-scripts Run `npm approve-scripts --allow-scripts-pending` to review, or `npm approve-scripts <pkg>` to allow.", "context": "", "use_case": "package management", "switched_from": "", "story": "MiMo Code Is Now Released and Open-Source"}, {"id": 775644769, "item_id": 48477798, "url": "https://news.ycombinator.com/item?id=48477798", "by": "cookiengineer", "date": "2026-06-10", "stance": "warn", "quote": "they will happily execute the malware payloads on install", "excerpt": "> \"cd folder\" does nothing. That's like recommending to use the xterm on Windows. Statistically, nobody uses their computer that way anymore. The world has moved on since the 1990s. I was only not affected because I use a heavily customized VIM, but even there can I not control how package managers like npm, pip or composer or go are behaving, because they will happily execute the malware payloads on install. And tim", "context": "", "use_case": "package management", "switched_from": "", "story": "Microsoft's open source tools were hacked to steal passwords of AI developers"}, {"id": 775578161, "item_id": 48473635, "url": "https://news.ycombinator.com/item?id=48473635", "by": "saljam", "date": "2026-06-10", "stance": "warn", "quote": "i'd still use less permissive containers for things i don't feel comfortable installing on the host, e.g. npm.", "excerpt": "the reason i use this (and just a container with -v $HOME:$HOME before) is to get an environment with all the command line tools i'm familiar with from debian, instead of using something like homebrew. in general, i mostly trust these with access to my home directory. a bonus is that i can throw it away and rebuild it easily if i need to. i'd still use less permissive containers for things i don't feel comfortable in", "context": "", "use_case": "", "switched_from": "", "story": "macOS Container Machines"}, {"id": 769652128, "item_id": 48103258, "url": "https://news.ycombinator.com/item?id=48103258", "by": "ezekg", "date": "2026-05-11", "stance": "warn", "quote": "I don't even know what to say here, npm.", "excerpt": "> Unpublish was unavailable for nearly all affected packages because of npm's \"no unpublish if dependents exist\" policy. We have to rely on npm security to pull tarballs server-side, which adds hours of delay during which malicious tarballs remain installable Per https://docs.npmjs.com/policies/unpublish: > If your package does not meet the unpublish policy criteria, we recommend deprecating the package. This allows ", "context": "", "use_case": "package registry", "switched_from": "", "story": "TanStack NPM Packages Compromised"}, {"id": 765958481, "item_id": 47872405, "url": "https://news.ycombinator.com/item?id=47872405", "by": "HiPhish", "date": "2026-04-22", "stance": "recommend", "quote": "but it gets the job done", "excerpt": "> written in Lisp (Guile Scheme) Doomed to obscurity. Look, I love Lisp like any other Lisper, but there is no proper Guile (let alone general Scheme) package manager, which means any Guile project will be be an uphill battle to maintain dependencies in. Oh well, at least it has a code of conduct, that has to count for something I guess? The fact of the matter is that there is just too much good stuff for the fronten", "context": "", "use_case": "frontend dependencies and tooling", "switched_from": "", "story": "Olive CSS: Lisp powered vanilla CSS utility-Class A la Tailwind"}, {"id": 748791440, "item_id": 46799465, "url": "https://news.ycombinator.com/item?id=46799465", "by": "EGreg", "date": "2026-01-28", "stance": "warn", "quote": "as devs we face supply chain attacks via npm and VSCode extensions", "excerpt": "I used to be worried about swarms of autonomous agents in the wild, running on open source software and LLMs. So they would be an advanced persistent threat, causing havoc at scale, impossible to eradicate. But it\u2019s even worse. There\u2019s literally no barrier. Millions of people are willing to download anything to their computer and give it access to their emails, etc. in the name of \u201cefficiency\u201d. They\u2019ll give the swarm", "context": "developer", "use_case": "", "switched_from": "", "story": "White hat astroturfed #1 ClawdBot/MoltBot skill that can pwn all users"}, {"id": 747209635, "item_id": 46700602, "url": "https://news.ycombinator.com/item?id=46700602", "by": "burntoutgray", "date": "2026-01-20", "stance": "warn", "quote": "Always disliked Node.js and especially npm.", "excerpt": "I use Bun or Deno for my projects. Always disliked Node.js and especially npm. Ryan Dahl created Deno to address his regrets regarding Node.js shortcomings, limitations.", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: Was Node.js a Mistake?"}, {"id": 743942720, "item_id": 46496420, "url": "https://news.ycombinator.com/item?id=46496420", "by": "kabes", "date": "2026-01-05", "stance": "warn", "quote": "NPM starts acting out", "excerpt": "To me, what sucks the most about programming is dealing with ecosystem issues. You want to write a little tool for personal use, but NPM starts acting out. Then you need to do something in java, which you don't use very often, and you get a giant maven error stack trace which you now need to try and understand. All of this frustration is gone since I use AI and I can focus solely on the thing I'm trying to accomplish", "context": "", "use_case": "JavaScript package management", "switched_from": "", "story": "Web development is fun again"}, {"id": 741686210, "item_id": 46355388, "url": "https://news.ycombinator.com/item?id=46355388", "by": "loumf", "date": "2025-12-22", "stance": "warn", "quote": "The main reason is to avoid npm", "excerpt": "I have recently gone all in on Python. Before I decided this, I was using Python for projects where I needed Pandas or numpy. I used React/TypeScript/Node for web applications. But, I moved to Django/HTMX. The main reason is to avoid npm, but also, I wanted something with more built-in defaults (my web apps have simple needs). It has nothing to do with the language -- it's more the ecosystem for me. I considered Ruby", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: Why Did Python Win?"}]}