Npm Security Best Practices

This walks you through hardening npm, pnpm, and Bun against supply chain attacks like dependency confusion and malicious postinstall scripts. You get actual .npmrc and pnpm-workspace.yaml configs that disable lifecycle scripts, block git dependencies, and enforce a 30-day minimum package age before installation. It covers real incidents like the event-stream attack and the Nx compromise, then shows how to use tools like Socket, npq, and allow-scripts for selective script execution. The Renovate config with minimumReleaseAge is especially useful if you want automated updates with a built-in cooldown period. It's thorough without being academic, which is rare for security guidance.

Install to Claude Code

npx -y skills add aradotso/security-skills --skill npm-security-best-practices --agent claude-code