npm-security-best-practices

Disabling npm lifecycle scripts blocks malicious postinstall hooks from executing during package installs. Configure your project environment to restrict executable scripts, preventing supply chain compromise in Node.js workflows.

Dependency confusion is a supply chain attack targeting internal packages. Secure npm installs against it by enforcing scoped registries and strict publish configurations to ensure packages are fetched from trusted, verified sources.

Enforce a minimum package release age by applying hardened trust policies in your package manager configuration. This mitigates risk from newly published compromised packages by delaying installs until they mature past initial publication.

Yes, this supply chain hardening applies to pnpm and Bun. It enforces trust settings, lockfile validation, and vulnerability scanning across Node.js package managers to secure CI/CD pipelines and local development environments.

The best way to run npx securely is to use safer npx usage practices and integrate supply chain scanning tools. This reduces typosquatting risks by verifying package provenance and restricting execution before running scaffolding commands.

Block git-based dependencies in your npm configuration to prevent supply chain compromise from unverified repository sources. Restricting installs to registry-published packages with provenance metadata ensures a hardened, trusted dependency tree.