skills.rest
susomejias
susomejiasCOMMUNITY
Explore all skills by this author →
Website𝕏@susomejiasGitHub

npm-security-best-practices

Harden npm-ecosystem dependency management against supply-chain attacks.

9|1|Updated May 13, 2026
Search Tags:#npm#pnpm#supply-chain-security#dependency-management#package-manager#lockfile-validation#ci-hardening
One-click install
npx skills add https://github.com/susomejias/rembric --skill npm-security-best-practices-susomejias
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: npm-security-best-practices
Source: https://github.com/susomejias/rembric/tree/main/.agents/skills/npm-security-best-practices
Command: npx skills add https://github.com/susomejias/rembric --skill npm-security-best-practices-susomejias

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill eliminates supply-chain attack risks for JavaScript and Node.js projects when adding dependencies, editing install configuration, reviewing lockfile changes, or setting up CI install steps, removing the need to manually research fragmented security guidance.

Core Features & Use Cases

  • 17-practice comprehensive guide: Covers all critical npm-ecosystem supply-chain hardening steps adapted from the industry-standard lirantal/npm-security-best-practices repository.
  • Multi-package-manager support: Includes actionable configuration snippets and guidance for npm, pnpm, yarn, and bun, with version-specific notes for pnpm 10.x and 11+.
  • Ready-to-use resources: Provides a one-page scan-friendly checklist for code reviews, copy-paste CI workflow snippets, and pre-written pnpm config blocks to speed up implementation.
  • Use Case: A team adding a new dependency to their pnpm project can use this Skill to immediately apply lockfile validation, install cooldown, and post-install script blocking without researching each practice individually.

Quick Start

Use this skill to implement full supply-chain hardening for your npm-ecosystem project when adding a new dependency or updating your CI install pipeline.

Frequently Asked Questions about npm-security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure npm dependencies and prevent supply-chain attacks in my project?▼

To prevent npm supply-chain attacks, disable post-install scripts, block exotic dependency sources, enforce release cooldowns, and validate lockfiles during CI setup. This Skill provides 17 actionable practices to eliminate these dependency management risks.

How do I disable post-install scripts in pnpm to harden my CI pipeline?▼

Disabling post-install scripts in pnpm requires specific configuration blocks in your .npmrc or pnpm-workspace.yaml files. This Skill provides pre-written pnpm config blocks and version-specific notes for pnpm 10.x and 11+ to block scripts and enforce deterministic install steps.

Does this supply-chain hardening guidance work with yarn and bun package managers?▼

Yes, this supply-chain hardening guidance works with yarn and bun package managers. It includes multi-package-manager support with actionable configuration snippets and specific validation steps covering npm, pnpm, yarn, and bun ecosystems for comprehensive dependency confusion prevention.

What is lockfile validation and how does it stop dependency confusion?▼

Lockfile validation stops dependency confusion by ensuring CI pipelines use deterministic install steps based on committed lockfile diffs rather than fetching unexpected package versions. This Skill provides copy-paste CI workflow snippets and a scan-friendly checklist to enforce lockfile validation.

How do I enforce a release cooldown for new npm packages?▼

Enforcing a release cooldown for new npm packages involves configuring your CI install pipeline to delay pulling recently published versions. This Skill provides ready-to-use resources and CI workflow snippets to immediately apply install cooldowns and prevent dependency confusion.

Can I get a code review checklist for npm supply-chain security best practices?▼

Yes, you can get a code review checklist for npm supply-chain security best practices. This Skill provides a one-page scan-friendly checklist covering 17 critical hardening steps adapted from the industry-standard lirantal/npm-security-best-practices repository for reviewing lockfile diffs and package.json changes.

Related Skills

Explore More Software Engineering Skills→
antfuantfu
5.7k

pnpm

Manage Node.js dependencies across monorepos with pnpm-workspace.yaml and .npmrc.

Community
Advanced
Galaxy-DawnGalaxy-Dawn
5.1k

uv-package-manager

Manage Python dependencies and virtual environments with uv.

Community
Intermediate
Paxeer-NetworkPaxeer-Network
3

security-audit

Compare two Git references to identify security regressions in code, dependencies, and CI/CD.

Official
Advanced
martinholovskymartinholovsky
45

CI/CD Pipeline Security Expert

Automate CI/CD pipeline security hardening with GitHub Actions.

Community
Advanced