← Learn
Dangerous
npm install --foreground-scripts https://example.com/pkg-1.0.0.tgz

cross-platform · javascript · Expert

Installs a package straight from a URL rather than the registry. There is no version resolution, no signature, and no audit trail, and any install script inside the tarball executes with your privileges as part of the install.

Signals to notice

  • Package fetched from an arbitrary URL
  • Install scripts execute automatically
  • Bypasses registry provenance checks

Think you can spot these under time pressure?

Start Training

More JavaScript / Node