Add .npmrc with security hardening settings

[danmcc-admin]

Summary

• Adds .npmrc with ignore-scripts=true and save-exact=true
• ignore-scripts=true prevents arbitrary code execution during npm install (supply chain defense)
• save-exact=true pins exact dependency versions for reproducible builds

If a package requires install scripts

Add a per-package allowlist in .npmrc:

lifecycle-script-allowed[]=sharp
lifecycle-script-allowed[]=esbuild

Or run one-off with:

npm install --ignore-scripts=false <package-name>

Context

Part of an org-wide security hardening initiative for all npm-based repositories.

[constructor-claude-bedrock]

Code Review

This PR adds a .npmrc file with ignore-scripts=true and save-exact=true for supply chain security hardening, but ignore-scripts=true breaks the existing prepare lifecycle script that installs Husky git hooks.

Inline comments: 2 discussions added

Overall Assessment: ⚠️ Needs Work

[constructor-claude-bedrock]

Critical Issue: Setting ignore-scripts=true will break the existing prepare script ("prepare": "husky install" in package.json). When any contributor runs npm install, Husky will no longer be set up automatically, meaning the pre-push lint hook (.husky/pre-push) won't be installed and will silently stop working.

The PR description mentions using a per-package allowlist (lifecycle-script-allowed[]=<pkg>) as a workaround, but that syntax is not supported by standard npm — it is specific to pnpm. For npm, there is no built-in per-package script allowlist.

Practical options to resolve this:

1. Remove ignore-scripts=true and rely on package-lock.json integrity + npm audit for supply chain defense instead.
2. Replace prepare with a manual step: Remove the prepare script and document that contributors must run npx husky install once after cloning. Update the README accordingly.
3. Use a .husky-aware workaround: Keep the setting but add a note in the README and CI configuration reminding contributors/CI to run npm run prepare explicitly after npm install --ignore-scripts.

[constructor-claude-bedrock]

Suggestion: save-exact=true only affects packages added via npm install <pkg> going forward — it does not pin the existing range-specifier dependencies already in package.json (e.g., "chai": "^4.3.4", "node-fetch": "^3.3.2", etc.). The existing devDependencies and dependencies still use ^ ranges, so reproducibility relies entirely on package-lock.json being committed and respected.

Consider updating the existing entries in package.json to exact versions to make the intent consistent, or document that package-lock.json is the primary reproducibility mechanism and save-exact=true is just a forward-looking guardrail.

[Copilot]

Pull request overview

Adds repository-level npm configuration to harden installs against supply-chain risks and improve reproducibility for dependency versioning in this Node.js client library.

Changes:

• Adds .npmrc with ignore-scripts=true to disable npm lifecycle scripts by default.
• Adds .npmrc with save-exact=true so newly added dependencies are saved with exact versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.