npm-security-best-practices

What problem does it solve?

npm package installs are frequently abused through malicious lifecycle scripts, dependency confusion, and compromised or newly published packages, which can lead to supply-chain compromise in Node.js projects.

Core Features & Use Cases

• Secure npm/pnpm/Bun install configuration: Provides hardened defaults such as disabling lifecycle scripts, blocking git-based dependencies, enforcing minimum release age, and applying pnpm trust policies.
• Mitigate common supply-chain attack patterns: Covers dependency confusion prevention via scoped registries and publish configuration, and reduces risk from typosquatting via safer npx usage.
• Security tooling integration: Recommends practical scanners and workflow tools (e.g., Snyk, npq, and Socket CLI) to identify vulnerabilities and issues before and during installs.

Quick Start

Configure your project to disable npm lifecycle scripts, block git dependencies, and enforce a minimum package release age using .npmrc (and then validate with an automated vulnerability scan before running installs).