Skip to content

Add .npmrc with security hardening settings #258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
danmcc-admin wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add .npmrc with security hardening settings #258

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
ignore-scripts=true

@constructor-claude-bedrock constructor-claude-bedrock Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical Issue: Setting ignore-scripts=true will break the existing prepare script ("prepare": "husky install" in package.json). When any contributor runs npm install, Husky will no longer be set up automatically, meaning the pre-push lint hook (.husky/pre-push) won't be installed and will silently stop working.

The PR description mentions using a per-package allowlist (lifecycle-script-allowed[]=<pkg>) as a workaround, but that syntax is not supported by standard npm — it is specific to pnpm. For npm, there is no built-in per-package script allowlist.

Practical options to resolve this:

  1. Remove ignore-scripts=true and rely on package-lock.json integrity + npm audit for supply chain defense instead.
  2. Replace prepare with a manual step: Remove the prepare script and document that contributors must run npx husky install once after cloning. Update the README accordingly.
  3. Use a .husky-aware workaround: Keep the setting but add a note in the README and CI configuration reminding contributors/CI to run npm run prepare explicitly after npm install --ignore-scripts.

save-exact=true

@constructor-claude-bedrock constructor-claude-bedrock Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: save-exact=true only affects packages added via npm install <pkg> going forward — it does not pin the existing range-specifier dependencies already in package.json (e.g., "chai": "^4.3.4", "node-fetch": "^3.3.2", etc.). The existing devDependencies and dependencies still use ^ ranges, so reproducibility relies entirely on package-lock.json being committed and respected.

Consider updating the existing entries in package.json to exact versions to make the intent consistent, or document that package-lock.json is the primary reproducibility mechanism and save-exact=true is just a forward-looking guardrail.

Comment on lines +1 to +2
Loading