Skip to the rows

agentsclimarketplace

Npm supply chain security

Skill fxckcode/skills-kit/skills/npm-supply-chain-security

A collection of agent skills for repository setup, multi-CLI agent workflows, and intelligent context loading.

Install

npx -y skills add fxckcode/skills-kit --skill npm-supply-chain-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Three-layer npm supply chain security: consumer basics, PNPM hardening, and publisher best practices (OIDC, Provenance, 2FA). Use when securing npm projects, auditing dependencies, evaluating install risks, or after supply chain attacks.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, as published. Nobody here has run it

npm Supply Chain Security

What This Skill Owns

Auditing and hardening npm dependency chains across three layers
Consumer-side security (ignore-scripts, lockfile validation, cooldown)
PNPM-specific hardening (strictDepBuilds, onlyBuiltDependencies, minimumReleaseAge)
Publisher-side practices (OIDC, Provenance, Trusted Publishers, 2FA)
Post-attack response and verification

When to Use

User says "secure my npm project", "supply chain security", "npm audit hardening"
After news of a supply chain attack (AnBe-style)
When onboarding a new npm project that needs dependency hardening
User asks about postinstall risks, lockfile injection, or PNPM security

Primary Capabilities

Capability	Description
Consumer hardening	ignore-scripts, version pinning, cooldown periods, npq/sfw wrappers
PNPM security	strictDepBuilds, onlyBuiltDependencies, lockfile-lint, minimumReleaseAge
Publisher security	OIDC tokens, npm provenance, Trusted Publishers, 2FA, files allow list
Verification	Lockfile URL validation, postinstall scanning, secret exposure checks

Three-Layer Model

Layer 1: Consumer Basics

Apply these to ANY npm project immediately:

npm config set ignore-scripts true
# Use exact versions, never latest
npm install [email protected] --ignore-scripts
# Cooldown: 3 days before installing new packages
# In .npmrc:
minimumReleaseAge=4320

Layer 2: PNPM Hardening

When using PNPM (recommended over npm):

# pnpm-workspace.yaml
onlyBuiltDependencies:
  - protobufjs
  - '@prisma/engines'
  # add what your project actually needs

# Validate lockfile URLs
npx lockfile-lint --path pnpm-lock.yaml --allowed-hosts npm --validate-https

Layer 3: Publisher

If you publish npm packages:

OIDC + Provenance — GitHub Actions with id-token: write permission + npm publish --provenance
Trusted Publisher — Configure on npmjs.com so only your GHA workflow can publish
2FA — Required, preferably with passkey
files allow list — "files": ["dist/", "README.md", "LICENSE"] in package.json

Pitfalls

postinstall is the most common attack vector — always review before updating
ERR_PNPM_IGNORED_BUILDS in pnpm 11+: approve builds with pnpm approve-builds <pkg> or add to onlyBuiltDependencies
OIDC publish fails without id-token: write permission in the workflow
Cooldown blocks urgent CVEs — maintain an exceptions list

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.