Mitigate npm supply-chain attacks via .npmrc file

ghostwriter · ghostwriter · commit 3813bac3c9c3 · 2026-05-20T11:16:32.000-05:00
- Add `ignore-scripts=true` to prevent execution of `postinstall` and other lifecycle scripts, supply-chain attack protection.
- Add `min-release-age=7` to avoids packages uploaded in the last 7 days, supply-chain attack protection. (Requires npm &gt;= 11.10.0)
- Add `package-lock=true` to ensure consistent dependency resolution across environments.

Signed-off-by: Nathanael Esayeas &lt;nathanael.esayeas@protonmail.com&gt;
diff --git a/.npmrc b/.npmrc
@@ -0,0 +1,3 @@
+ignore-scripts=true
+min-release-age=7
+package-lock=true

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+ignore-scripts=true`
	`2`	`+min-release-age=7`
	`3`	`+package-lock=true`