cdxgen
cdxgen copied to clipboard
[docs] Remove references to npm install -g
npm install -g is one of the least secure ways of installing an npm package and its dependencies. The core maintainers have absolutely no control regarding the full dependency tree that might get installed. We need to remove references to these and replace them with something better.
https://github.com/search?q=repo%3ACycloneDX%2Fcdxgen+npm+install+-g+%40cyclonedx&type=code
What do we use it for? For running cdxgen? Personally, I prefer to NEVER install with -g if I can help it: put it in package.json! That way, you can actually have multiple versions installed -- specific to your project.