Applies safer package manager defaults and dependency vetting to JavaScript and TypeScript projects to reduce supply-chain attack risk.
The automated check flagged lines worth reading first. See the safety section below.
$ npx skills add bodadotsh/npm-security-best-practices --skill npm-security -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install bodadotsh/npm-security-best-practices npm-security --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/bodadotsh/npm-security-best-practices.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/npm-security .claude/skills/npm-security && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "npm-security" agent skill from https://github.com/bodadotsh/npm-security-best-practices/tree/main/skills/npm-security into .claude/skills/npm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "npm-security", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/bodadotsh/npm-security-best-practices/tree/main/skills/npm-securityType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add bodadotsh/npm-security-best-practices --skill npm-security -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install bodadotsh/npm-security-best-practices npm-security --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/bodadotsh/npm-security-best-practices.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/npm-security .agents/skills/npm-security && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "npm-security" agent skill from https://github.com/bodadotsh/npm-security-best-practices/tree/main/skills/npm-security into .agents/skills/npm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "npm-security", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add bodadotsh/npm-security-best-practices --skill npm-security -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install bodadotsh/npm-security-best-practices npm-security --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/bodadotsh/npm-security-best-practices.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/npm-security .cursor/skills/npm-security && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "npm-security" agent skill from https://github.com/bodadotsh/npm-security-best-practices/tree/main/skills/npm-security into .cursor/skills/npm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "npm-security", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/bodadotsh/npm-security-best-practices.git --path skills/npm-security--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add bodadotsh/npm-security-best-practices --skill npm-security -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install bodadotsh/npm-security-best-practices npm-security --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/bodadotsh/npm-security-best-practices.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/npm-security .gemini/skills/npm-security && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "npm-security" agent skill from https://github.com/bodadotsh/npm-security-best-practices/tree/main/skills/npm-security into .gemini/skills/npm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "npm-security", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install bodadotsh/npm-security-best-practices npm-securityInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add bodadotsh/npm-security-best-practices --skill npm-security -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/bodadotsh/npm-security-best-practices.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/npm-security .github/skills/npm-security && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "npm-security" agent skill from https://github.com/bodadotsh/npm-security-best-practices/tree/main/skills/npm-security into .github/skills/npm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "npm-security", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add bodadotsh/npm-security-best-practices --skill npm-security -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install bodadotsh/npm-security-best-practices npm-security --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/bodadotsh/npm-security-best-practices.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/npm-security .opencode/skills/npm-security && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "npm-security" agent skill from https://github.com/bodadotsh/npm-security-best-practices/tree/main/skills/npm-security into .opencode/skills/npm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "npm-security", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
npm-securityApplies safer package manager defaults and dependency vetting to JavaScript and TypeScript projects to reduce supply-chain attack risk.
This skill sets safer defaults for JavaScript and TypeScript projects so installing dependencies is less exposed to supply-chain attacks. It uses npm for its examples but tells the agent to check which package manager is present (npm, pnpm, yarn, bun or deno), confirm its version and verify settings against the official documentation. It never overrides a configuration the user has set on purpose.
Three defaults apply unless the user has chosen otherwise: lifecycle scripts such as preinstall and postinstall are switched off (ignore-scripts=true in .npmrc), new releases must age through a cooldown of 3 days (min-release-age=3), and exact versions are saved instead of ranges (save-exact=true). They go into the project's .npmrc only for keys not already set. When choosing third-party packages, it suggests scoring candidates first with the Socket MCP server, deps.dev or OpenSSF Scorecard, and rejecting those below a health threshold the user sets, or a sensible default of around 80.
Read from SKILL.md and the folder at commit 24fb07d. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
npmnpxFrom the folder's file list and the shell code blocks in SKILL.md.
Hosts in commands or code, which the agent is likely to contact:
mcp.socket.devAlso links to:
github.comdeps.devboda.shdocs.npmjs.compnpm.ioyarnpkg.combun.shdocs.deno.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
npm Supply Chain Security loads about 1k tokens when it runs. Until then it costs about 57 tokens; SKILL.md has 465 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found patterns that need a careful read before installing.
In `.npmrc`, this can be set as `ignore-scripts=true`, or through install command: `npm install --ignore-scripts <packagIn `.npmrc`, this can be set as `min-release-age=3`, or through install command `npm install --min-release-age=3 <packagIn `.npmrc`, this can be set as `save-exact=true`, or through install command `npm install --save-exact <package>`Persist these defaults in the project `.npmrc` (or the package manager’s equivalent), merging only keys that are unset;Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from bodadotsh/npm-security-best-practices at commit 24fb07d, republished under its MIT licence (© bodadotsh). 465 words, ~1,027 tokens.
.claude/skills/npm-security/SKILL.md (or your agent's skills folder).Apply the following security best practices. NEVER override an explicit user opt-in config (lifecycle scripts, cooldowns, save prefix, etc) unless they ask. Always check current package manager's verions, and verify against their official documentations.
Best practices are safer and sensible environmental defaults that should be enabled for the agent's runtime, we are using npm as example here but you should check to see which package manager is available and apply the configurations according.
Unless explicitly defined otherwise, package managers should have lifecycle scripts set as off, for example preinstall and postinstall.
In .npmrc, this can be set as ignore-scripts=true, or through install command: npm install --ignore-scripts <package>.
Unless explicitly defined otherwise, dependency installations should respect a cooldown period (default to 3 days).
In .npmrc, this can be set as min-release-age=3, or through install command npm install --min-release-age=3 <package>.
Unless explicitly defined otherwise, package installations should install the expact version instead of a semver range.
In .npmrc, this can be set as save-exact=true, or through install command npm install --save-exact <package>
Persist these defaults in the project
.npmrc(or the package manager’s equivalent), merging only keys that are unset; never overwrite existing values unless the user asks.
When planning third-party dependencies, we should score package candidates first. This reduces risk of greyware (not malware, but can be trollware, abandonware, low quality, license changes, etc).
Few free and trustworthy scorers are:
For example, Socket MCP server can be figured as:
{
"mcpServers": {
"socket-mcp": {
"type": "http",
"url": "https://mcp.socket.dev/"
}
}
}Once installed, use the MCP to ask questions like:
The user should set a policy of when to reject dependencies based on their health metrics (quality, supply chain, maintenance, etc), else default to a sensible number (e.g., 80).
When it is time to install third-party dependencies, we should wrap the installation command with a package scanner first. This reduces risk of compromises as the scanner will check against a real-time intelligence database.
Few free and trustworthy scanners are:
FOr example, the sfw cli can be downloaded first through npm i -g sfw or through npx: npx sfw npm install <package>
Even as a popular and well-known package passes the planning/scoring stage, the installation/scanning stage can catch it if they get compromised.
© bodadotsh, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in skills/npm-security of bodadotsh/npm-security-best-practices.
Open the folder on GitHubat commit 24fb07d
npm Supply Chain Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| npm Supply Chain Security this skillbodadotsh/npm-security-best-practices | 858 | — | ~1k | Automated safety check: Warn | MIT | |
| Linea Dependency MaintenanceConsensys-Incorporated/linea-attestation-registry | 177 | 1 repos | ~3.7k | Automated safety check: Warn | MIT | |
| Migrate to Denodenoland/skills | 100 | — | ~2.2k | Automated safety check: Warn | MIT | |
| Check npmgrafana/skills | 281 | — | ~1.3k | Automated safety check: Warn | Apache-2.0 | |
| npm Supply Chain Checkmajiayu000/spellbook | 287 | — | ~1.5k | Automated safety check: Pass | MIT | |
| Stash Supply Chain Securitycipherstash/stack | 157 | — | ~5.2k | Automated safety check: Warn | MIT |
Consensys-Incorporated/linea-attestation-registry
Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions…
denoland/skills
Moves a Node.js, npm, Yarn, pnpm or Bun project to Deno in reversible steps, starting with Deno as the package manager and changing no code unless needed.
grafana/skills
Audit a JavaScript/TypeScript repo's npm, yarn, or pnpm configuration for supply-chain hardening: tool version, lifecycle scripts, unsafe dependency protocols, and minimum release age ≥3 days.
majiayu000/spellbook
Scans a repository, its lockfiles and node_modules for known malicious npm package versions and install-time indicators, using a read-only Python scanner.
cipherstash/stack
Supply-chain security controls for the @cipherstash/stack monorepo.
QuentinCody/interlinked-cli
Respond to blocked package installs and manage the Interlinked supply-chain allowlist.
Works with
Categories
Applies safer package manager defaults and dependency vetting to JavaScript and TypeScript projects to reduce supply-chain attack risk. This skill sets safer defaults for JavaScript and TypeScript projects so installing dependencies is less exposed to supply-chain attacks. It uses npm for its examples but tells the agent to check which package manager is present (npm, pnpm, yarn, bun or deno), confirm its version and verify settings against the official documentation.
npm Supply Chain Security fits situations like: planning which third-party packages a project should depend on; installing or updating dependencies in an npm, pnpm, yarn, bun or deno project; configuring .npmrc with ignore-scripts, exact versions and a release-age cooldown; scoring package candidates before adding them.
Run `npx skills add bodadotsh/npm-security-best-practices --skill npm-security -a claude-code`. Or copy the skill folder (skills/npm-security in bodadotsh/npm-security-best-practices) into .claude/skills/npm-security in your project. Claude Code loads it when a task matches its description.
Run `npx skills add bodadotsh/npm-security-best-practices --skill npm-security -a codex`. Or copy the skill folder (skills/npm-security in bodadotsh/npm-security-best-practices) into .agents/skills/npm-security in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add bodadotsh/npm-security-best-practices --skill npm-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/npm-security, .gemini/skills/npm-security, .github/skills/npm-security and .opencode/skills/npm-security in your project.
Going by SKILL.md and its folder, npm Supply Chain Security needs the command-line tools its instructions call (npm and npx). Our summary lists: A JavaScript or TypeScript project using npm, pnpm, yarn, bun or deno.
SKILL.md names 9 domains. In commands or code: mcp.socket.dev; the agent is likely to contact it when it follows the instructions. As links in the text: github.com, deps.dev, boda.sh, docs.npmjs.com, pnpm.io, yarnpkg.com, bun.sh and docs.deno.com. This is read from the text; nothing was executed.
Our automated static check of SKILL.md flagged 4 warning(s): mentions a credentials file (ssh keys, cloud or package-manager tokens). Read the flagged lines before installing; the check is not a guarantee either way.
npm Supply Chain Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with npm Supply Chain Security: Linea Dependency Maintenance (Consensys-Incorporated/linea-attestation-registry, 177 stars), Migrate to Deno (denoland/skills, 100 stars), Check npm (grafana/skills, 281 stars) and npm Supply Chain Check (majiayu000/spellbook, 287 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
bodadotsh (a GitHub user) maintains it in bodadotsh/npm-security-best-practices, which has 858 GitHub stars. The repository was last updated on September 30, 2026.
Source: bodadotsh/npm-security-best-practices on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
