diff --git a/.npmrc b/.npmrc
index cffe8cde..e5911cd8 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,8 @@
 save-exact=true
+# Ensures that npm doesn't pull fresh unvetted packages.
+min-release-age=7
+# Ensures that npm doesn't run scripts during install, through which
+# 99% of supply chain attacks are executed.
+ignore-scripts=true
+# Ensures that npm doesn't allow git dependencies that can bypass above settings.
+allow-git=none