You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
(socket) svelte-preprocess@5.0.4 contains risks:
Install scripts - Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Accept risks of installing these packages (y/N)?
the message is intended for users, but I agree that it would be better if it was made at runtime if a missing dependency was detected. vite handles this for sass for example, reminding you to install it if you didn't
it is however not a security issue in this case as it only runs "echo". You can safely disable this postinstall script with your package manager if it still concerns you
See also: @SocketDev
Feature requests and proposals
The
postinstall
script will always run, even for deeply nested dependencies.The
prepublish
script will run when someone is runningnpm install
from the repo, and beforenpm publish
.Currently the install script is used to write a message to the screen which is not actually necessary for people who have this as a dependency.
The text was updated successfully, but these errors were encountered: