npm-security

Apply the following security best practices. Never override an explicit user opt-in config (lifecycle scripts, cooldowns, save prefix, etc) unless they ask.

Always check current package manager's verions, and verify against their official documentations. See "References" for links or perfom web searches.

Environment defaults

For the following best practices, we are using npm as example but you should check to see which package manager is available and apply the configurations according.

Lifecycle scripts

Unless explicitly defined otherwiese, package managers should have lifecycle scripts set as off, for example preinstall and postinstall.

In .npmrc, this can be set as ignore-scripts=true, or through install command: npm install --ignore-scripts <package>.

Cooldowns / minimum release age

Unless explicitly defined otherwiese, package installations should respect a cooldown period (default to 1 day).

In .npmrc, this can be set as min-release-age=1, or through install command npm install --min-release-age=1 <package>.

Exact versions

Unless explicitly defined otherwise, package installations should install the expact version instead of a semver range.

In .npmrc, this can be set as save-exact=true, or through install command npm install --save-exact <package>

Persist these defaults in the project .npmrc (or the package manager’s equivalent), merging only keys that are unset; never overwrite existing values unless the user asks.

Planning stage / package scorer

When planning third-party dependencies, we should score package candidates first. This reduces risk of using greyware (dependencies are not exactly malware, but can be trollware, abandonware, low quality, etc).

A free scorer solution is the Socket MCP server. Can use other package scorers if user configured explicitly.

An example Socket MCP server can be figured as:

{
  "mcpServers": {
    "socket-mcp": {
      "type": "http",
      "url": "https://mcp.socket.dev/"
    }
  }
}