npm install commands should include --ignore-scripts #4198
Description
npm install <package-name> allows scripts to be run alongside/during package installation. This has been a vector for one of the worst npm malware attacks to date (see link: https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/)
To help protect students of this course from falling victim to such attacks (and instill good practice when dealing with npm), it may be worth modifying all instances of npm install <package-name> within the course contents to npm install <package-name> --ignore-scripts, along with an explanation of why this is added.
For those who wish to know more, see HN discussion thread: https://news.ycombinator.com/item?id=46032539
A list of affected packages may be found here: https://www.koi.ai/incident/live-updates-sha1-hulud-the-second-coming-hundred-npm-packages-compromised