Supply Chain Security

Controls applied in this repo to limit blast radius from compromised npm packages, lockfile injection, dependency confusion, and rushed dependency upgrades. Sourced from lirantal/npm-security-best-practices and adapted for our pnpm workspace.

When to Use This Skill

• Modifying any file under .github/workflows/
• Editing pnpm-workspace.yaml, package.json pnpm block, or .npmrc
• Updating .github/dependabot.yml or .github/CODEOWNERS
• Adding a dependency that needs a build script (i.e. node-gyp, node-pty, prebuilt binaries)
• Bypassing the install cooldown for a security fix
• Publishing a package to npm under a name that has never been published before
• Reviewing a PR that touches any of the above

What's Enforced (Config + Test Gate)

Each control below is validated by e2e/tests/supply-chain.e2e.test.ts — the test suite fails CI if a control regresses, so silent removal isn't possible.

1. Post-install scripts disabled by default — practice #1