From 31523a95f95e7d9be421812a3d9de39d1bf56a94 Mon Sep 17 00:00:00 2001 From: Igor Stepanenko Date: Fri, 7 Aug 2026 22:00:09 +0100 Subject: [PATCH] Harden npm installs from supply chain attacks --- .npmrc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.npmrc b/.npmrc index cffe8cde..e5911cd8 100644 --- a/.npmrc +++ b/.npmrc @@ -1 +1,8 @@ save-exact=true +# Ensures that npm doesn't pull fresh unvetted packages. +min-release-age=7 +# Ensures that npm doesn't run scripts during install, through which +# 99% of supply chain attacks are executed. +ignore-scripts=true +# Ensures that npm doesn't allow git dependencies that can bypass above settings. +allow-git=none