cdxgen icon indicating copy to clipboard operation
cdxgen copied to clipboard

[docs] Remove references to npm install -g

Open prabhu opened this issue 5 months ago • 1 comments

npm install -g is one of the least secure ways of installing an npm package and its dependencies. The core maintainers have absolutely no control regarding the full dependency tree that might get installed. We need to remove references to these and replace them with something better.

https://github.com/search?q=repo%3ACycloneDX%2Fcdxgen+npm+install+-g+%40cyclonedx&type=code

prabhu avatar Sep 08 '25 19:09 prabhu

What do we use it for? For running cdxgen? Personally, I prefer to NEVER install with -g if I can help it: put it in package.json! That way, you can actually have multiple versions installed -- specific to your project.

malice00 avatar Sep 12 '25 19:09 malice00