Sister issue to the one in ttag-cli.
Lately many packages have been hit with supply chain attacks, mainly thrugh npm's auto-update ^ and postinstall behaviours (ref1, ref2).
A lot of that risk can be mitigated by pinning versions and ensuring npm always installs whatever the lockfile has.
npm install will install the latest dependency on the available range.
Sister issue to the one in ttag-cli.
Lately many packages have been hit with supply chain attacks, mainly thrugh npm's auto-update
^and postinstall behaviours (ref1, ref2).A lot of that risk can be mitigated by pinning versions and ensuring npm always installs whatever the lockfile has.
npm installwill install the latest dependency on the available range.