Hacker News new | ask | show | jobs
by skybrian 3687 days ago
Maybe that's the problem? The file format is too loose and it shouldn't allow arbitrary content anywhere.
2 comments

This seems like a situation where npm can't win. If it only allows npm-specific information in the package.json, then people will complain about how they have to have 10 different configuration files in the root of a JavaScript project. If they allow arbitrary configuration, it's blamed for being too permissive.
There are other possibilities. They could have a registry for allowed keys, or allow them but only under "extensions".
Even so, your error parser could examine common layouts, and figure out that while depndencies could be correct, it probably was meant to be dependencies.