---
title: "Discussion on \"Provenance Isn't Proof: What to Check Before You `npm install -g` a Tunnel CLI\" | Hashnode"
description: "Discussion on \"Provenance Isn't Proof: What to Check Before You `npm install -g` a Tunnel CLI\". npm provenance isn't proof of safety. Learn how to vet a tunnel CLI before npm install -g: pin versions, ignore-scripts, verify checksums, limit"
url: "https://hashnode.com/posts/provenance-isn-t-proof-what-to-check-before-you-npm-install-g-a-tunnel-cli/6af156735fb96ee873f33bac"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Provenance Isn't Proof: What to Check Before You \`npm install -g\` a Tunnel CLI](https://instatunnel.hashnode.dev/provenance-isn-t-proof-what-to-check-before-you-npm-install-g-a-tunnel-cli?utm_source=hashnode&utm_medium=feed)

npm provenance isn't proof of safety. Learn how to vet a tunnel CLI before npm install -g: pin versions, ignore-scripts, verify checksums, limit

3d ago · 12 min read · instatunnel.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#networking](https://hashnode.com/tag/networking)
-   [#devops](https://hashnode.com/tag/devops)
-   [#programming-ciovqvfcb008mb253jrczo9ye](https://hashnode.com/tag/programming-ciovqvfcb008mb253jrczo9ye)
-   [#webdev](https://hashnode.com/tag/webdev)

## Written by

[InstaTunnel](https://hashnode.com/@instatunnel)

@instatunnel

  
[View profile](https://hashnode.com/@instatunnel)

InstaTunnel - The Professional ngrok Alternative That's 40% Cheaper

## Responses

Markdown supported · ⌘↵ to post

No responses yet.