I am starting to use npm install a lot for development, but I fear about its security consequences. Does npm install retrieve binaries or sources?

If it's binaries, it's already a deal breaker for me.

If it's sources, what level of scrutiny is the node.js community having over the package repository? (E.g. I would like to compare this repository to other repositories, such as debian package repositories, which I guess are the safest out there.)

  • 2
    What's the difference between binaries and sources when you run JavaScript in node.js? – aventurin Nov 5 '16 at 16:20
  • Rory McCune, did a good talk about this. He's pretty active on this site, so you may hear from him directly. – paj28 Nov 5 '16 at 16:29
  • pretty ironic that the link to that security talk requires Flash ;) – knocte Nov 5 '16 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.