010101 package security
Multi-domain agent skills collection for AI coding agents (Claude, Cursor, Copilot, OpenCode, and more). Covers programming, biology, cooking, and future domains. Installable via npx skills add.
npx -y skills add natuleadan/skills --skill 010101-package-securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Secures npm, pnpm, and bun against supply chain attacks — lockfile enforcement, provenance, version pinning, dependency audit, and script blocking.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.0 KB, as published. Nobody here has run it
Package Manager Security
This skill helps you harden npm, pnpm, and bun against supply chain attacks. It provides configuration guides, best practices, and troubleshooting for all three package managers.
How to use this skill
- Identify which package manager(s) the user's query is about (npm, pnpm, bun, or multiple)
- If they ask about npm → read
references/npm.md - If they ask about pnpm → read
references/pnpm.md - If they ask about bun → read
references/bun.md - If they ask about multiple or general concepts (lockfiles, CI/CD, version pinning) → read all relevant files
- Answer concisely and directly. Provide configuration snippets and commands the user can copy/paste.
Common concepts (apply to all three)
These security practices apply regardless of package manager. Mention them when relevant.
Lockfile enforcement
- Always commit the lockfile:
package-lock.json(npm),pnpm-lock.yaml(pnpm),bun.lock(bun) - In CI/CD, use the frozen-lockfile equivalent:
- npm:
npm ci - pnpm:
pnpm install --frozen-lockfile - bun:
bun install --frozen-lockfile
- npm:
- Review lockfile changes in PRs — unexpected additions can indicate compromised deps
Version pinning
- Prefer exact versions (
"axios": "1.12.0") over ranges ("axios": "^1.12.0") - Tilde ranges (
"axios": "~1.12.0") are safer than caret ranges for production - Never use
"*"or"latest"in production
Supply chain monitoring
npm audit signatures— verify package provenance- Integrate SCA (Software Composition Analysis) tools for vulnerability scanning
- Block known C2 domains at the firewall/DNS level
Audit existing setup
Run python scripts/audit.py to check global security settings (npmrc, pnpm config, bunfig).
Run python scripts/audit-project.py from your project root to check project-level settings (package.json: overrides, engines, packageManager, pnpm config).
Run python scripts/scan-exotic.py to scan lockfiles for dependencies from exotic sources (git repos, tarballs, local paths). Use --ci to fail in CI if any exotic deps found.
Output format
When providing configuration:
- Show the exact file content (with file path comment)
- Explain what each setting does
- Provide the command to apply it
- If troubleshooting, explain the root cause
References
references/npm.md— npm-specific security configurationreferences/pnpm.md— pnpm-specific security configurationreferences/bun.md— bun-specific security configurationreferences/cross-cutting.md— Registries, overrides, engines, SBOM, lockfile review, git depsscripts/audit.py— Audit script that checks all global security settingsscripts/audit-project.py— Project-level audit (package.json checks)scripts/scan-exotic.py— Lockfile scanner for exotic dependency sources