Comment

Comment by an_ko

This is wildly unsafe.

- Some packages contain non-JS files for good reasons, and they may break in subtle unpredictable ways when you mess with the contents of their package.

- Node.js will happily run JavaScript files even if they're not "*.js": A file like "hello.alsdfhlshdfl" works just fine as long as its content parses. There is no guarantee that your dependencies (and their recursive dependencies) don't statically or dynamically load files with completely arbitrary filenames.

- If you distribute packages with license files stripped this way, you are violating licenses that require the license to be distributed along with the code.

If this is actually a major issue for you, consider instead sending PRs to upstream to tidy up their package. This will also benefit other users.

parent an_ko 2 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton