Enforce flags for publishing npm packages to public repositories for the first time

[Alirun]

Hey there

I'm wondering, why is it possible to publish new package into public repository without any confirmation in first place?

I get that npm publish is very handy, and it's ok for it to work as is, by why only scoped packages are being checked at the first publish?

Also a question, why don't include "private": true into every generated package.json by default?
I think that if you need to explicitly remove this line, it's convenient and is much safer and better, than not having it in by default at all.

[sedoy26]

wow, this is mind-blowing, thanks for sharing

[juanpicado]

I'm wondering, why is it possible to publish new package into public repository without any confirmation in first place?

I think was already discussed here. at RFC: Add publish confirmation prompt and https://github.com/npm/rfcs/blob/main/accepted/0028-publish-prompt.md

[Alirun]

Thanks for the reference, I guess it does solve the first aforementioned problem with prompt-less npm publish

But I still think that having "private": true by default in package.json would be great to have too

[Alirun]

Do you know if I can proceed with PR containing RFC?

[juanpicado]

According to the README you can https://github.com/npm/rfcs#how-does-review-work , all discussions should happen there. But seems all usually start with creating an issue rather than a discussion.