bodadotsh/npm-security-best-practices
Npm Security Best Practices
This project provides a comprehensive guide for securing the software supply chain within Node.js and npm environments. It focuses on hardening the entire lifecycle of third-party dependencies and package publishing processes to protect applications from malicious code injection and unauthorized registry modifications.
The guide distinguishes itself by emphasizing identity-based authentication and cryptographic provenance to verify the origin of distributed artifacts. It advocates for strict governance policies, such as enforcing minimum release ages for dependencies and disabling automatic lifecycle scripts, to mitigate risks associated with newly published or untrusted code.
The documentation covers a broad range of security practices, including deterministic dependency resolution through lockfiles, granular access control for registry tokens, and automated vulnerability auditing. It also details methods for minimizing the attack surface by restricting published files and overriding transitive dependencies to ensure consistent, predictable builds across development and production environments.
Features
- Software Supply Chain Security - Secures the entire lifecycle of third-party dependencies and build processes to protect against malicious code injection.
- Awesome List - A community-curated directory that catalogs and links out to other open-source projects, rather than a standalone tool you run yourself.
- Dependency Governance - Standardizes dependency installation and versioning to ensure consistent, predictable, and secure builds.
- Build Provenance Attestors - Generates cryptographic attestations during package publishing to provide verifiable proof of build origin and integrity.
- Registry Security - Provides guidance for hardening authentication, access control, and artifact provenance in software registries.
- Project Lockfile Management - Maintains consistent dependency versions across environments by generating and enforcing project lockfiles.
- Dependency Vulnerability Scanners - Scans project dependencies for known security flaws and provides automated remediation paths.
- Identity-Based Authentication - Implements identity-based authentication to replace long-lived registry tokens with secure, short-lived identity assertions.
- Dependency Lock Managers - Locks dependency versions to specific states to prevent unauthorized changes or malicious code injection.
- Package Publishing - Implements identity-based authentication and strict file controls for secure package distribution.
- Pre-installation Security Auditing - Integrates security checks into the installation workflow to block malicious packages before they enter the project.
- Installation Script Disablers - Blocks the automatic execution of pre- and post-install scripts to prevent malicious code execution.
- Installation Integrity Verification - Integrates automated vulnerability scanning into the installation workflow to block malicious code before it enters the project.
- Lifecycle Script Sandboxes - Intercepts and disables automated package installation hooks to prevent arbitrary code execution during dependency setup.
- Package Security - Provides comprehensive configuration settings to harden package manager security and mitigate supply-chain risks.
- Installation Policies - Restricts package installation by enforcing security policies to prevent unauthorized or malicious code execution.
- Dependency Lockfiles - Commits dependency lockfiles to version control to ensure identical package installations across all environments.
- Governance Policies - Enforces organizational security constraints like minimum release ages and trust levels during dependency installation.
- Node.js Development Utilities - Standardizes Node.js dependency management to ensure consistent and secure builds across environments.
- Dependency Override Managers - Manages local overrides for nested dependencies to mitigate risks from broad version ranges and insecure sub-dependency configurations.
- Installation Cooldown Managers - Enforces a minimum age requirement for new package versions to mitigate risks from newly published malicious releases.
- Trusted Publishing - Implements identity-based authentication to eliminate long-lived tokens and enable automatic provenance generation.
- Registry Access Controls - Secures package publishing through granular access tokens and multi-factor authentication.
- Artifact Filters - Restricts the contents of published packages to essential files to prevent accidental exposure of sensitive data.
- Publishing Policies - Limits the contents of published packages to essential files to prevent accidental exposure of sensitive data.
- Artifact Filtering - Restricts the set of files included in a package to minimize the attack surface and prevent accidental data exposure.
- Version Pinning Tools - Enforces exact dependency versions to ensure consistent and predictable builds across environments.
- Version and Compatibility Management - Configures package managers to use strict build requirements and consistent version prefixes for reproducible dependency resolution.
- Token Access Restrictions - Generates granular access tokens with limited scopes and expiration to minimize credential compromise risks.
- Dependency Minimizers - Replaces third-party utility libraries with native language features to reduce the overall attack surface.
