npm
Fewer than 5 people recommend it so far, so there's no written verdict. Here is what commenters said.
2recommend
14warn against
Dec 22, 2025first mention
Oct 31, 2026latest mention
Why people recommend it
“Fortunately npm v12+ disables lifecycle scripts by default.”
switched from pnpmon “Friendship ended with Deno, now Node is my best friend”
“but it gets the job done”
Caveats and dissent
“I never trust npm, pypi, etc. any longer.”
“the benefits of having no npm and related ecosystem tools and no dependencies”
Show 2 more
“The JavaScript ecosystem is a dumpster fire within a miasma-infested cloaca.”
“Given its security model, i think spicy is a far more apt label.”
Often compared with
Threads where it came up
- Malware uses LLMs to rank victims by how much they're worth 1 mention
- Telegram Desktop vulnerability allowed any user's file to be stolen 1 mention
- Friendship ended with Deno, now Node is my best friend 1 mention
- SvelteKit 3 1 mention
- Pig: Pi in Go, a port that plans on keeping up 1 mention
- Pnpm 12.0 1 mention
Data: npm.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 18
“I use min-release-age =14 for npm now as a default”
“I never trust npm, pypi, etc. any longer.”
“Fortunately npm v12+ disables lifecycle scripts by default.”
“the benefits of having no npm and related ecosystem tools and no dependencies”
“The JavaScript ecosystem is a dumpster fire within a miasma-infested cloaca.”
“Given its security model, i think spicy is a far more apt label.”
“I love the smell of npm install malware in the morning.”
“the malware is still distributed through NPM. Legendary platform.”
“for the love of God don't touch anything that uses npm”
“I use npm 11.16.0”
“they will happily execute the malware payloads on install”
“i'd still use less permissive containers for things i don't feel comfortable installing on the host, e.g. npm.”
“I don't even know what to say here, npm.”
“but it gets the job done”
“as devs we face supply chain attacks via npm and VSCode extensions”
“Always disliked Node.js and especially npm.”
“NPM starts acting out”
“The main reason is to avoid npm”