Npm Security Best Practices
aradotso/security-skillsnpm is a tool that lets you add code packages to your projects. However some packages can contain hidden dangerous code. This is called a supply chain attack. This guide helps you stop those attacks.
You will learn to change settings in npm, pnpm, and Bun. For example you can disable postinstall scripts that can run malicious commands. You can also block packages that are too new or come from git URLs. These steps make your project safer.
The guide also covers tools like @lavamoat/allow-scripts for fine control over which packages can run scripts. Following these best practices keeps your code and your users safe.
Add Npm Security Best Practices skill to your workflow
Global
mkdir -p ~/.claude/skills/npm-security-best-practicesProject
mkdir -p .claude/skills/npm-security-best-practicesSource Repository
More Security Claude Code Skills
Azure Compliancemicrosoft/azure-skills
Audit Azure compliance and Key Vault expiration with azqr scans
Firebase Security Rules Auditorfirebase/agent-skills
Find weak spots in Firestore rules and get clear fixes
Golang Securitysamber/cc-skills-golang
Find and fix security flaws in Go code using expert guidance and automated tools
Clerk Nextjs Patternsclerk/skills
Secure your Next.js app with Clerk middleware, server actions, and caching
Persona It Admingoogleworkspace/cli
Keep your digital workspace safe with IT admin security workflows
Two Factor Authentication Best Practicesbetter-auth/skills
Secure user logins with two-factor authentication using Better Auth
Gws Modelarmor Create Templategoogleworkspace/cli
Create new templates for Google Model Armor to protect AI apps from harmful content
Gws Modelarmor Sanitize Promptgoogleworkspace/cli
Clean user prompts safely with Google Model Armor templates