Add npm min-release-age security setting - #243
Conversation
Delays installing newly published npm packages to reduce exposure to supply-chain compromises, and excludes .npmrc from the distribution build.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d66d6311bf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -0,0 +1 @@ | |||
| min-release-age=7 | |||
There was a problem hiding this comment.
npm's min-release-age documentation defines this value in seconds, so 7 delays eligible releases by only seven seconds rather than the seven days stated in the commit. This leaves the intended supply-chain protection effectively absent; use 604800 for seven days.
Useful? React with 👍 / 👎.
| @@ -0,0 +1 @@ | |||
| min-release-age=7 | |||
There was a problem hiding this comment.
Checked .github/workflows/pr-playground-preview.yml: the install job selects Node 20 and immediately runs npm ci, while Node 20 ships npm 10 (for example, the Node 20.19.5 release includes npm 10.8.2), whose config reference does not support min-release-age. In that workflow the option is treated as unknown and ignored, so pin or install a supporting npm version before relying on this control.
Useful? React with 👍 / 👎.
2 participants
Summary
.npmrcwithmin-release-age=7, delaying installs of npm packages until 7 days after publish to reduce exposure to supply-chain attacks (e.g. compromised maintainer accounts pushing malicious versions that get caught/pulled quickly)..npmrcfrom the distribution build via.distignore.Test plan
.distignorestill lists existing entries correctly with.npmrcadded under the "Develop" section.Generated by Claude Code