Merge pull request #57 from palantirnet/npm-supply-chain

agentrickard · web-flow · commit c237a4e14bd3 · 2026-05-07T11:39:17.000-04:00
SI-460: Mitigate node/npm supply chain attacks by disabling lifecycle scripts and git dependencies.
diff --git a/.npmrc b/.npmrc
@@ -0,0 +1,5 @@
+# Disable lifecycle scripts to mitigate supply chain attacks.
+ignore-scripts = true
+
+# Disable git repositories as package sources to mitigate supply chain attacks.
+allow-git = root
diff --git a/.yarnrc.yml b/.yarnrc.yml
@@ -0,0 +1,8 @@
+# Legacy node_modules behavior.
+nodeLinker: node-modules
+
+# Disable lifecycle scripts to mitigate supply chain attacks.
+enableScripts: false
+
+# Disable git repositories as package sources to mitigate supply chain attacks.
+approvedGitRepositories: [ ]
