search

berstend / node-safe

🤠 Make using Node.js safe again with Deno-like permissions
https://node-safe.com
205 stars 8 forks source link

[Feature idea] [Package managers]: Detect `publish` and allow access to `~/.npmrc` automatically #3

Open berstend opened 2 years ago

berstend commented 2 years ago

Currently we block all access ~/.npmrc for security reasons (explained in the main readme).

It could be convenient to automatically allow access to that file when publishing related package manager commands are invoked.

To make that as secure as possible we could parse the package.json and make sure there's no lifecycle events present (prepublish, etc) that could run scripts that might steal the npm credentials.