- Did you know there are at least 139 packages on npm that start with a hyphen/dash? Curiously some of them look like CLI flags! --frozen-lockfile --fix-lockfile --legacy-peer-deps --ignore-scripts --ignore-workspace-root-check You've also got the package with a single dash for a name `-`
- I compiled a list here if anyone is interested, although there may be more as I'm missing some packuments from my replica cache! gist.github.com/ghostdevv/db...
- `--frozen-lockfile`, `--ignore-scripts`, `--fix-lockfile`, and `--ignore-workspace-root-check` all contain one JS file from the same author - it's pretty incredible stuff actuallyFeb 6, 2026 12:54
- --legacy-peer-deps was pulled by npm as it did infact contain malicious code, good spot @lukewarlow.dev bsky.app/profile/luke...
- Maybe there are some more interesting ones out there? Just please don't install them in case they are malware! 😄
