Question around dummy packages in monorepo test
plygrnd opened this issue · 3 comments
Hi folks,
We came across @my-scope/package-a and @my-scope/package-b when reviewing Resolve for internal use at my employer. Does the Browserify team own the @my-scope scope on NPM? I ask because we want to rule out the possibilty of dependency confusion within Resolve's test suite.
Nope - their package.json has private:true, so their names don’t matter.
@ljharb Thanks, thought as much but I wanted to check. Someone owns @my-scope on NPM, is why I asked; there were some concerns internally about someone publishing package-[a|b] on NPM and causing problems with Resolve, but I think that's highly unlikely.
Those concerns are incorrect; nothing with private:true can be published, and a package.json in a test fixture isn't part of npm install so there's zero chance of pulling a same-named package from a registry.