`npx wrangler` 可能下载并执行未固定版本的软件包
原文依据:3 处多项检查和账户操作直接使用 `npx wrangler`。如果项目没有本地固定版本,npx 可能从软件包注册表取得并执行当前版本,从而在用户机器上运行并非本仓库固定依赖的代码。
被替换、受污染或不兼容的软件包版本可能访问当前项目与可用凭据,或执行错误的 Cloudflare 操作。
风险在条件成立时受源码支持:多个活动指令直接运行未固定版本的 `npx wrangler`。若项目没有本地锁定的 Wrangler,npx 可能取得并执行注册表版本,获得该命令在用户机器上的权限。参考资料虽要求检查已安装版本,但未明确禁止下载。用户可限制网络并要求显示将执行的本地版本。
1. **Domain onboarded?** Run `npx wrangler email sending list` to see which domains have email sending enabled. If the domain isn't listed, run `npx wrangler email sending enable userdomain.com` or see [cli-and-mcp.md](references/cli-and-mcp.md) for full setup instructions.2. **Binding configured?** Look for `send_email` in `wrangler.jsonc` (for Workers)3. **postal-mime installed?** Run `npm ls postal-mime` (only needed for receiving/parsing emails)查看另外 2 个位置
For full CLI reference, run `npx wrangler email --help`. For Dashboard setup, see the [getting started docs](https://developers.cloudflare.com/email-service/get-started/).Read the documentation for the selected task before implementing. Inspect the project's installed Wrangler and Agents SDK versions, configuration, and existing conventions first. Run `wrangler types` through the project's package manager after changing bindings; use its generated types instead of handwritten email interfaces. See [Workers TypeScript](https://developers.cloudflare.com/workers/languages/typescript/) for matching types to the project's compatibility date and flags. Do not upgrade dependencies just to match an example.