Npm Security Best Practices
This walks you through hardening npm, pnpm, and Bun against supply chain attacks like dependency confusion and malicious postinstall scripts. You get actual .npmrc and pnpm-workspace.yaml configs that disable lifecycle scripts, block git dependencies, and enforce a 30-day minimum package age before installation. It covers real incidents like the event-stream attack and the Nx compromise, then shows how to use tools like Socket, npq, and allow-scripts for selective script execution. The Renovate config with minimumReleaseAge is especially useful if you want automated updates with a built-in cooldown period. It's thorough without being academic, which is rare for security guidance.
- skills.sh installs
- 770
- GitHub stars
- 6
- last updated
- Jul 14, 2026
Install
$ npx -y skills add aradotso/security-skills --skill npm-security-best-practices --agent claude-codeInstalls into .claude/skills of the current project.
Files
npm Security Best Practices
Skill by ara.so — Security Skills collection.
This skill provides expert guidance on securing npm package installations, preventing supply chain attacks, and implementing security best practices for Node.js development. Based on the comprehensive npm-security-best-practices repository by Lirantal.
Overview
The npm ecosystem is a frequent target for supply chain attacks including:
- Shai-Hulud attacks - Worm-like propagation through compromised packages
- Nx incident - Malicious code in postinstall scripts
- event-stream attack - Long-running exfiltration via lifecycle scripts
- Dependency confusion - Attackers publishing malicious packages with internal names
This skill covers configuration, tooling, and practices to mitigate these risks across npm, pnpm, and Bun.
Secure-by-Default Configuration
npm (.npmrc)
Create or update .npmrc in your project root or global config (~/.npmrc):
# Disable all lifecycle scripts (postinstall, preinstall, etc.)
ignore-scripts=true
# Block git-based dependencies (git+ssh://, git+https://, etc.)
allow-git=none
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/aradotso/security-skills
- Category
- Security
- First seen
- Jul 14, 2026
More from aradotso/security-skills
All 58- Malware Awareness Bitdefender Crack Fraud767
- Security Detections Mcp754
- Malware Repository Warning748
- Malware Detection And Reporting747
- Malware Analysis Warning731
- Malware Distribution Awareness717
- Kali Pentest Ai Agent697
- Bitdefender Malware Analysis686
- Skill File Security681
- Bitdefender Malware Investigation677
- Zen Ai Pentest Framework676
- Edgesecurityaccess Wireguard Vpn670
- Sparkfinderoven Security Compliance Skills661
- Securityclaw Autonomous Soc Agent659
- Security Compliance Skills Suite Claude652
- Pentestify Security Report Generator639
- Awesome Claude Code Security Compliance Suite633
- Sparkfinderoven R01 Security Compliance Skills630
- Sparkfinderoven Claude Security Compliance Suite625
- S800 Vehicle Network Security Testing623
- Sparkfinderoven Security Compliance Suite622
- Esaa Security Audit617
- Foundry Security Spec586
- Anthropic Cybersecurity Skills1.3K
Recommended
More Security
awesome-claude-code-security-compliance-suitearadotso/security-skillsawesome claude code security compliance suite633skills.sh installs
rust-securitymohitmishra786/low-level-dev-skillsRust security skill for supply chain safety and memory-safe development. Use when auditing dependencies with cargo-audit, enforcing policies with cargo-deny, re624skills.sh installss800-vehicle-network-security-testingaradotso/security-skillss800 vehicle network security testing623skills.sh installs