Agent skill · security · aradotso
npm-security-best-practices
Expert guidance on securing npm packages, preventing supply chain attacks, and hardening package manager configurations
Why this skill is useful
Provides specific npm security configurations and commands to prevent supply chain attacks that the AI wouldn't reliably generate on its own.
What it needs
About 6k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
npm Security Best Practices Skill by ara.so — Security Skills collection. This skill provides expert guidance on securing npm package installations, preventing supply chain attacks, and implementing security best practices for Node.js development. Based on the comprehensive npm-security-best-practices repository by Lirantal. Overview The npm ecosystem is a frequent target for supply chain attacks including: Shai-Hulud attacks - Worm-like propagation through compromised packages Nx incident - Malicious code in postinstall scripts event-stream attack - Long-running exfiltration via lifecycle scripts Dependency confusion - Attackers publishing malicious packages with internal names This skill covers configuration, tooling, and practices to mitigate these risks across npm, pnpm, and Bun. Secure-by-Default Configuration npm (.npmrc) Create or update .npmrc in your project root or global config (~/.npmrc): Apply globally: pnpm (pnpm-workspace.yaml) Create pnpm-workspace.yaml in your project root: Bun (package.json) Bun disables postinstall scripts by default. To allow specific packages: Installation Commands Secure npm install Secure pnpm install Selective script execution Use @lavamoat/allow-scripts for granular control: Example package.json: Hardening npx Execution Security Tooling Integration npq - Package quality and security checks Socket Firewall (sfw) Snyk - Vulnerability scanning Automated Dependency Updates with Cooldown Renovate Bot (renovate.json) Dependabot (.github/dependabot.yml) Use GitHub Actions to enforce cooldown: Lockfile Security Prevent lockfile injection .gitattributes protection Package Health Assessment Snyk Advisor lookup Manual verification checklist Run: Preventing Dependency Confusion .npmrc scoped registries package.json name scoping Dev Container Security .devcontainer/devcontainer.json Environment Variable Security Use .env.vault instead of plaintext .env Access encrypted secrets Maintainer Best Practices Enable 2FA on npm account Publish w …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/npm-security-best-practices