# lirantal/npm-security-best-practices

Collection of npm package manager Security Best Practices

Repository: https://github.com/lirantal/npm-security-best-practices
Canonical: https://ross.abutalabs.com/products/npm-security-best-practices
License: Apache-2.0
License Family: permissive
Topics: awesome, awesome-list, best-practices, nodejs, npm, security, supply-chain-security, vulnerabilities, shai-hulud, shai-hulud-attack, shai-hulud-detector
Last push: 2026-05-24T18:40:02+00:00

## Health v2 (maintenance only)
Score: 55/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 84, release rhythm 35, longevity 23
- inputs: {"age_days": 335, "days_push": 101, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1248, forks 42 (observed 2026-08-28T04:04:07.685804+00:00)

## What it is
A curated awesome-list of npm package manager security best practices, covering safe-by-default CLI options, supply chain attack hardening, and secure dependency resolution. It includes copy-paste secure configurations for npm, pnpm, and bun package managers.

## Use cases
- harden npm against supply chain attacks
- disable postinstall scripts safely
- block recently published npm packages
- secure .npmrc configuration examples
- mitigate shai-hulud style npm compromises
- vet npm package dependencies for security
- configure pnpm security settings

## When to choose
- you maintain Node.js projects and want to reduce npm supply chain risk
- you need practical, copy-paste package manager security configs
- you want a curated reference of npm security practices

## When to avoid
- you need an automated security scanning tool rather than guidance
- you are not using npm, pnpm, or bun as your package manager

## Facets
- artifact type: learning-resource
- maturity: active
- function: security, developer-tools, documentation
- domain: security, developer-tools, awesome-lists, web-development
- platform: cli
- tags: npm, supply-chain-security, best-practices, awesome-list, pnpm, bun, package-manager-security, shai-hulud, nodejs

## Member repositories
- lirantal/npm-security-best-practices (main) score 55

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:07.685804+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:07:53.537231+00:00, confidence not recorded.
  - readme: https://github.com/lirantal/npm-security-best-practices (fetched 2026-08-28T04:04:07.685804+00:00, sha b4a024058bf1)
- Data as of 2026-08-30T08:39:29.467469+00:00.