{"action":"opened","issue":{"url":"https://api.github.com/repos/HaxeFoundation/haxelib/issues/183","labels_url":"https://api.github.com/repos/HaxeFoundation/haxelib/issues/183/labels{/name}","comments_url":"https://api.github.com/repos/HaxeFoundation/haxelib/issues/183/comments","events_url":"https://api.github.com/repos/HaxeFoundation/haxelib/issues/183/events","html_url":"https://github.com/HaxeFoundation/haxelib/issues/183","id":62071954,"number":183,"title":"Post install hooks","user":{"login":"back2dos","id":509501,"avatar_url":"https://avatars.githubusercontent.com/u/509501?v=3","gravatar_id":"","url":"https://api.github.com/users/back2dos","html_url":"https://github.com/back2dos","followers_url":"https://api.github.com/users/back2dos/followers","following_url":"https://api.github.com/users/back2dos/following{/other_user}","gists_url":"https://api.github.com/users/back2dos/gists{/gist_id}","starred_url":"https://api.github.com/users/back2dos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/back2dos/subscriptions","organizations_url":"https://api.github.com/users/back2dos/orgs","repos_url":"https://api.github.com/users/back2dos/repos","events_url":"https://api.github.com/users/back2dos/events{/privacy}","received_events_url":"https://api.github.com/users/back2dos/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/HaxeFoundation/haxelib/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-16T12:53:48Z","updated_at":"2015-03-16T12:53:48Z","closed_at":null,"body":"This one goes mostly to @ncannasse who has opposed this up until now.\r\n\r\nI'm not really against, because with macros, malicious code can be executed with simply by calling `-lib evillib` (which has `--macro evellib.CitadelOfDoom.worldDomination()`).\r\n\r\nThe one issue I see is that there are situations where users need to run haxelib with sudo, in which case a post install hook would have more permissions. But generally you shouldn't sudo if you don't know what you're doing. \r\n\r\nNPM is a significantly bigger ecosystem and they don't seem to run into problems with this. Unless there is serious opposition on this, I'd like to add it. If need be, we can still `ask` for confirmation and the brave ones can just skip that with `--always`. Thoughts?"}}