From e1e87345db6027e6aca67d5440f4a44b7184fbbf Mon Sep 17 00:00:00 2001 From: dbutts29 Date: Tue, 9 Jun 2026 14:13:28 -0700 Subject: [PATCH 1/2] Add .npmrc with ignore-scripts=true to block dependency install hooks Prevents npm from auto-running dependency lifecycle scripts (preinstall/install/postinstall) on install, mitigating the Miasma/Shai-Hulud npm supply-chain worm class. Co-Authored-By: Claude Opus 4.8 (1M context) --- .npmrc | 1 + 1 file changed, 1 insertion(+) create mode 100644 .npmrc diff --git a/.npmrc b/.npmrc new file mode 100644 index 00000000..97b895e2 --- /dev/null +++ b/.npmrc @@ -0,0 +1 @@ +ignore-scripts=true From e7948ea2ac895a57973f45cb451edc779617eeff Mon Sep 17 00:00:00 2001 From: dbutts29 Date: Fri, 12 Jun 2026 14:23:48 -0700 Subject: [PATCH 2/2] PLA-1580: make build produce the examples tgz under ignore-scripts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `.npmrc` ignore-scripts=true blocks malicious dependency install hooks (the Miasma mitigation) but also suppresses npm's own pre/post run-script hooks, so `npm run build` ran webpack while the `postbuild` hook (validate:es5 + update:snippets + pack) silently never fired. Result: no examples/rollbar.tgz, and the "Validate examples" CI step failed on every leg. Replace the `postbuild` / `postbuild:dev` auto-hooks with an explicit `build:finalize` step invoked from `build` and `build:dev`. Explicit `npm run` invocations still execute under ignore-scripts (only the implicit pre/post hooks are blocked), so the tgz is produced again — without re-enabling install hooks. No double-run in normal environments since the hook names are gone. Verified locally with ignore-scripts active: `npm run build` produces examples/rollbar.tgz and `npm run validate:examples` passes all 15 examples. Co-Authored-By: Claude Opus 4.8 --- package.json | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/package.json b/package.json index 74d7ae8b..ad7cbd1a 100644 --- a/package.json +++ b/package.json @@ -132,10 +132,9 @@ "webpack-node-externals": "^3.0.0" }, "scripts": { - "build": "webpack --mode production", - "postbuild": "npm run validate:es5 && npm run update:snippets:examples && npm run pack", - "build:dev": "webpack --mode development", - "postbuild:dev": "npm run postbuild", + "build": "webpack --mode production && npm run build:finalize", + "build:dev": "webpack --mode development && npm run build:finalize", + "build:finalize": "npm run validate:es5 && npm run update:snippets:examples && npm run pack", "test": "npm run test:wtr && npm run test:server", "test:server": "node scripts/run-server-tests.js", "test:wtr": "web-test-runner",