# npm-security-best-practices

Guides npm dependency hardening, supply-chain attack prevention, and safer package-manager settings. Useful when reviewing Node.js installs.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 919 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/npm-security-best-practices/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/npm-security-best-practices

## What it does

This skill covers npm package security, package-manager configuration, and ways to reduce supply-chain attack risk. It explains how to disable lifecycle scripts, block git dependencies, enforce release-age checks, and allow build scripts only for selected packages.

The material includes npm, pnpm, and Bun examples, plus workflows for `npx`, `@lavamoat/allow-scripts`, `npq`, Socket Firewall, and Snyk. It also covers `.npmrc`, `pnpm-workspace.yaml`, `package.json`, lockfiles, Renovate, and Dependabot. Some checks require the relevant CLI tools and Snyk authentication.

The practical tradeoff is clear: disabling scripts can break packages that need a build step, so review the allowlist before applying the settings.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill npm-security-best-practices -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/npm-security-best-practices/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/npm-security-best-practices/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill npm-security-best-practices -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/npm-security-best-practices/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill npm-security-best-practices -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/npm-security-best-practices/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills npm-security-best-practices
```

2. **Manually: put the files in place**
- File: `.github/skills/npm-security-best-practices/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill npm-security-best-practices -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/npm-security-best-practices
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/npm-security-best-practices/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill npm-security-best-practices -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/npm-security-best-practices/SKILL.md

## When to use it
- harden npm dependency installation
- block lifecycle scripts and git dependencies
- check a package before adding it
- delay adoption of newly released versions
- review suspicious lockfile changes

## Example prompts
- Review this project’s npm setup and propose a safer `.npmrc` that disables scripts and blocks git dependencies.
- Show how to install a package securely with `npm`, `pnpm`, and `npx`, including supply-chain checks.
- Set up selective build-script permissions with `@lavamoat/allow-scripts` and explain which packages need approval.

## Similar
- [check-npm](https://affpapa.org/en/nevibecode/skills/check-npm.md) — skill · 2800 installs
- [sap-dependency-security](https://affpapa.org/en/nevibecode/skills/sap-dependency-security.md) — skill · 558 installs
- [aube-package-manager](https://affpapa.org/en/nevibecode/skills/aube-package-manager.md) — skill · 392 installs
- [add-npm-dependency](https://affpapa.org/en/nevibecode/skills/add-npm-dependency.md) — skill · ★ 1388
- [dependency-upgrade](https://affpapa.org/en/nevibecode/skills/secondsky-dependency-upgrade.md) — skill · 404 installs
- [npm-package](https://affpapa.org/en/nevibecode/skills/npm-package.md) — skill · 331 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 17 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md