Somebody has to install system software.
npm is basically a giant array that anyone can add package to.
I'm using them both accordingly.
Debatable but irrelevant.
I'm not saying npm is a good or bad system package manager, just that running arbitrary scripts for requested packages and their dependencies is hardly unique.
It's oblivious to single out npm as a package manager that allows you to be pwned by packages in whatever repo you pull from.
npm gathers sources from a central registry which anyone can upload packages to — and furthermore package references don’t even have to be references to entities in the registry but can also be links to arbitrary git repos ...
Furthermore the set of dependencies to actually be downloaded is quite a bit more dynamic with npm I think because of the version compatability satisfaction algorithm employed by npm — so it’s inherently harder to statically analyze the set of packages a given npm install execution will install vs rpm/apt.
Honestly -- I think npm should be updated to exit without doing anything if it detects its run with root privileges ...
