Yes, none of npm's lifecycle hooks. You're just pulling bytes over the wire.
Except now you're making http calls to remote servers that could be compromised.
alt Hacker News
Except now you're making http calls to remote servers that could be compromised.