Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add @euberdeveloper/eslint-plugin #537

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

euberdeveloper
Copy link

No description provided.

Copy link

@mileslane mileslane left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should not use dependencies that have a small user and developer base. It is extremely risky, as there are many bad actors who are using such packages to install malware. I see no reason to merge a package whose primary function, at the best, would be to simply add a bundle of other dependencies.

@euberdeveloper
Copy link
Author

Yes but this way I can not use your service with my code. I guess that this is a problem of other people, too

@mileslane
Copy link

Yes, that's true. I would be more concerned for your risk exposure. I opened a similar issue for several Babel plugins. I personally avoid using NPM packages with few users and developers. I don't want any obscure, poorly supported plugins in my code. Adding the plugin to the codeclimate-eslint package.json does not increase anyone's risk.

@euberdeveloper
Copy link
Author

In this case (to me) it's not obscure since it is written by me...

I find it as a very comfortable way to add my customized eslint configuration to all my projects and I prefer renouncing using code climate than renouncing to those configurations

@euberdeveloper
Copy link
Author

In any case small user base means only more potential damage, not that it is a bigger risk... Look what happened with colour.js and faker.js

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants