skills.rest
tacogips
tacogipsCOMMUNITY
Explore all skills by this author →
𝕏@yu_kawa_tacoGitHub

supply-chain-secure-install

Secure npm dependency installation with Bun's lifecycle script blocking and lockfile verification.

1|Updated Feb 3, 2026
Search Tags:#ci/cd#security#npm#dependency management#bun#supply chain
One-click install
npx skills add https://github.com/tacogips/QraftBox --skill supply-chain-secure-install
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-secure-install
Source: https://github.com/tacogips/QraftBox/tree/main/.agents/skills/supply-chain-secure-install
Command: npx skills add https://github.com/tacogips/QraftBox --skill supply-chain-secure-install

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides robust defenses against npm supply chain attacks by leveraging Bun's security features and best practices for dependency management.

Core Features & Use Cases

  • Lifecycle Script Blocking: Bun blocks malicious scripts by default, unlike npm/yarn.
  • Cooldown Period: minimumReleaseAge prevents installation of freshly published, potentially compromised packages.
  • Hardened Configuration: Guides users through bunfig.toml security settings.
  • Dependency Trust Management: Manages trustedDependencies to allow necessary scripts safely.
  • Lockfile Security: Ensures lockfiles are committed and verified.
  • CI/CD Hardening: Protects build pipelines from attack vectors.
  • Use Case: Securely install all project dependencies using Bun, ensuring that no malicious code can execute during the installation process and that only well-established package versions are used.

Quick Start

Apply the supply-chain-secure-install skill to audit and secure the npm dependencies for the current project using Bun.

Frequently Asked Questions about supply-chain-secure-install

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure npm dependencies against supply chain attacks using Bun?▼

To secure npm dependencies against supply chain attacks using Bun, you enforce bunfig.toml hardening, block lifecycle scripts by default, and apply minimumReleaseAge to prevent installing freshly published packages.

What are Shai-Hulud attack vectors in npm dependency management?▼

Shai-Hulud attack vectors in npm dependency management are supply chain threats executed through lifecycle scripts, freshly published compromised packages, and lockfile integrity tampering during the installation process.

How do I configure bunfig.toml to block malicious lifecycle scripts?▼

Configuring bunfig.toml to block malicious lifecycle scripts involves enabling Bun's default script blocking and explicitly managing trustedDependencies to safely allow scripts only for necessary, verified packages.

Can I prevent installing freshly published npm packages in a CI/CD pipeline?▼

Yes, you can prevent installing freshly published npm packages in a CI/CD pipeline by setting the minimumReleaseAge property in Bun, which enforces a cooldown period before a new release can be installed.

How do I manage trustedDependencies in Bun for necessary lifecycle scripts?▼

Managing trustedDependencies in Bun involves adding specific, verified package names to the trustedDependencies list in bunfig.toml, which permits their lifecycle scripts to execute while blocking all others by default.

Why does Bun block lifecycle scripts by default compared to npm?▼

Bun blocks lifecycle scripts by default to prevent malicious code execution during installation, unlike npm or yarn which run them automatically, requiring explicit trust management for package scripts.

Related Skills

Explore More Software Engineering Skills→
bughqbughq
2

stacks-configuration

Manage Stacks framework project files including bunfig.toml, tsconfig.json, and environment variables.

Official
Intermediate
MesteriisMesteriis

supply-chain-review

Review build supply chains for security and integrity risks.

Community
Advanced
luissimon96luissimon96

graph-dependency

Audit dependencies, generate SBOMs, and check license compliance for software projects.

Community
Advanced
efiadmefiadm

dependency-installer

Detect package managers from lock files and install project dependencies.

Community
Advanced