npm Supply Chain Security
What This Skill Owns
- Auditing and hardening npm dependency chains across three layers
- Consumer-side security (ignore-scripts, lockfile validation, cooldown)
- PNPM-specific hardening (strictDepBuilds, onlyBuiltDependencies, minimumReleaseAge)
- Publisher-side practices (OIDC, Provenance, Trusted Publishers, 2FA)
- Post-attack response and verification
When to Use
- User says "secure my npm project", "supply chain security", "npm audit hardening"
- After news of a supply chain attack (AnBe-style)
- When onboarding a new npm project that needs dependency hardening
- User asks about postinstall risks, lockfile injection, or PNPM security
Primary Capabilities
| Capability |
Description |
| Consumer hardening |
ignore-scripts, version pinning, cooldown periods, npq/sfw wrappers |
| PNPM security |
strictDepBuilds, onlyBuiltDependencies, lockfile-lint, minimumReleaseAge |
| Publisher security |
OIDC tokens, npm provenance, Trusted Publishers, 2FA, files allow list |
| Verification |
Lockfile URL validation, postinstall scanning, secret exposure checks |
Three-Layer Model
Layer 1: Consumer Basics
Apply these to ANY npm project immediately:
npm config set ignore-scripts true
# Use exact versions, never latest
npm install paquete@1.2.3 --ignore-scripts
# Cooldown: 3 days before installing new packages
# In .npmrc:
minimumReleaseAge=4320
Layer 2: PNPM Hardening
When using PNPM (recommended over npm):
# pnpm-workspace.yaml
onlyBuiltDependencies:
- protobufjs
- '@prisma/engines'
# add what your project actually needs
# Validate lockfile URLs
npx lockfile-lint --path pnpm-lock.yaml --allowed-hosts npm --validate-https
Layer 3: Publisher
If you publish npm packages:
- OIDC + Provenance — GitHub Actions with
id-token: write permission + npm publish --provenance
- Trusted Publisher — Configure on npmjs.com so only your GHA workflow can publish
- 2FA — Required, preferably with passkey
- files allow list —
"files": ["dist/", "README.md", "LICENSE"] in package.json
Pitfalls
postinstall is the most common attack vector — always review before updatingERR_PNPM_IGNORED_BUILDS in pnpm 11+: approve builds with pnpm approve-builds <pkg> or add to onlyBuiltDependencies- OIDC publish fails without
id-token: write permission in the workflow
- Cooldown blocks urgent CVEs — maintain an exceptions list
1---2name: npm-supply-chain-security3description: Three-layer npm supply chain security: consumer basics, PNPM hardening, and publisher best practices (OIDC, Provenance, 2FA). Use when securing npm projects, auditing dependencies, evaluating install risks, or after supply chain attacks.4license: Apache-2.05---67# npm Supply Chain Security89## What This Skill Owns1011- Auditing and hardening npm dependency chains across three layers12- Consumer-side security (ignore-scripts, lockfile validation, cooldown)13- PNPM-specific hardening (strictDepBuilds, onlyBuiltDependencies, minimumReleaseAge)14- Publisher-side practices (OIDC, Provenance, Trusted Publishers, 2FA)15- Post-attack response and verification1617## When to Use1819- User says "secure my npm project", "supply chain security", "npm audit hardening"20- After news of a supply chain attack (AnBe-style)21- When onboarding a new npm project that needs dependency hardening22- User asks about postinstall risks, lockfile injection, or PNPM security2324## Primary Capabilities2526| Capability | Description |27|---|---|28| Consumer hardening | ignore-scripts, version pinning, cooldown periods, npq/sfw wrappers |29| PNPM security | strictDepBuilds, onlyBuiltDependencies, lockfile-lint, minimumReleaseAge |30| Publisher security | OIDC tokens, npm provenance, Trusted Publishers, 2FA, files allow list |31| Verification | Lockfile URL validation, postinstall scanning, secret exposure checks |3233## Three-Layer Model3435### Layer 1: Consumer Basics3637Apply these to ANY npm project immediately:3839```bash40npm config set ignore-scripts true41# Use exact versions, never latest42npm install paquete@1.2.3 --ignore-scripts43# Cooldown: 3 days before installing new packages44# In .npmrc:45minimumReleaseAge=432046```4748### Layer 2: PNPM Hardening4950When using PNPM (recommended over npm):5152```yaml53# pnpm-workspace.yaml54onlyBuiltDependencies:55 - protobufjs56 - '@prisma/engines'57 # add what your project actually needs58```5960```bash61# Validate lockfile URLs62npx lockfile-lint --path pnpm-lock.yaml --allowed-hosts npm --validate-https63```6465### Layer 3: Publisher6667If you publish npm packages:68691. **OIDC + Provenance** — GitHub Actions with `id-token: write` permission + `npm publish --provenance`702. **Trusted Publisher** — Configure on npmjs.com so only your GHA workflow can publish713. **2FA** — Required, preferably with passkey724. **files allow list** — `"files": ["dist/", "README.md", "LICENSE"]` in package.json7374## Pitfalls7576- `postinstall` is the most common attack vector — always review before updating77- `ERR_PNPM_IGNORED_BUILDS` in pnpm 11+: approve builds with `pnpm approve-builds <pkg>` or add to `onlyBuiltDependencies`78- OIDC publish fails without `id-token: write` permission in the workflow79- Cooldown blocks urgent CVEs — maintain an exceptions list
fxckcode