node-supply-chain

Layers the defenses that made the difference in real npm attacks — and names what each layer does not cover. The failures this skill fixes: models recommend npm install in CI, blanket auto-merge for bot PRs (a documented malware path), treat cooldowns as full protection, and apply npm-specific script policies to pnpm/yarn repos where they do nothing.

When NOT to use

• GitHub repo settings (rulesets, secret scanning, PVR) → repo-settings tooling outside this collection (e.g. the github-skills repo-protections skill).
• Publishing your own package with provenance → node-release.
• Fixing a CVE in your own code → ordinary dev work.

Workflow