To summarize, for users who have alternate NPM configurations and use private and/or NPM mirrors, it can be easy to install packages from a source other than the official NPM registry without realizing it. It's in Cordova's interest to ensure that NPM runs with a configuration of using the official NPM registry.
registry=https://registry.npmjs.org
Feature Request
.npmrcfile to assert usinghttps://registry.npmjs.orgregistry.Motivation Behind Feature
https://lists.apache.org/thread.html/raa963b0c2349e8d08d6c2f9d557b9055402d6410d35d4e9573b63cab%40%3Cdev.cordova.apache.org%3E
To summarize, for users who have alternate NPM configurations and use private and/or NPM mirrors, it can be easy to install packages from a source other than the official NPM registry without realizing it. It's in Cordova's interest to ensure that NPM runs with a configuration of using the official NPM registry.
We can correct this via adding an
.npmrcfile to each of our repos with the following config:Implementation Progress
Platforms
Plugins
Tooling
Excluded:
cordova-statuscordova