{"id":23662796,"url":"https://github.com/wille/package-policy","last_synced_at":"2026-02-06T19:30:49.862Z","repository":{"id":270157897,"uuid":"898521986","full_name":"wille/package-policy","owner":"wille","description":"Package policies for Node.js repos to protect against supply chain attacks","archived":false,"fork":false,"pushed_at":"2024-12-29T21:21:05.000Z","size":51,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-08-22T13:54:35.604Z","etag":null,"topics":["dependencies","node","nodejs","npm","pnpm","security","supply-chain-security","yarn"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/wille.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-04T14:46:20.000Z","updated_at":"2024-12-29T21:21:08.000Z","dependencies_parsed_at":"2024-12-28T22:25:45.411Z","dependency_job_id":"acaeabef-37fa-4831-96b7-e3c59831ea92","html_url":"https://github.com/wille/package-policy","commit_stats":null,"previous_names":["wille/package-policy"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/wille/package-policy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wille%2Fpackage-policy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wille%2Fpackage-policy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wille%2Fpackage-policy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wille%2Fpackage-policy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/wille","download_url":"https://codeload.github.com/wille/package-policy/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wille%2Fpackage-policy/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29174045,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-06T19:28:14.811Z","status":"ssl_error","status_checked_at":"2026-02-06T19:28:13.420Z","response_time":59,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dependencies","node","nodejs","npm","pnpm","security","supply-chain-security","yarn"],"created_at":"2024-12-29T05:14:03.374Z","updated_at":"2026-02-06T19:30:49.853Z","avatar_url":"https://github.com/wille.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003e [!NOTE]  \n\u003e pnpm now has native support for [minimumReleaseAge](https://github.com/pnpm/pnpm/pull/9957) and this package is not needed\n\n\n[![NPM package](https://img.shields.io/npm/v/package-policy.svg?style=flat-square)](https://www.npmjs.com/package/package-policy)\n[![Node version](https://img.shields.io/badge/node-%3E=_18-blue?style=flat-square)](https://www.npmjs.com/package/package-policy)\n\n# package-policy\n\nSetup a dependency policy for your Node.js repo to protect against supply chain attacks and malicious dependencies.\n\npackage-policy will scan your lockfile and the NPM registry and check if the dependencies are passing the policy. If a dependency does not pass, the command will fail and the user will have to manually whitelist the dependency.\n\n## Features\n\n## Minimum package version age\n\nUsage: `minPackageAge: 2d`\n\nSet a minimum age policy of included packages to guard against recently hijacked npm packages.\nThis has happened several times in the wild to popular packages and is commonly detected within hours of the package being published.\n\nIt's important to be aware that this is an realistic attack vector and that the most common of these could have been saved\n\nRead more:\n\u003e https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident\n\u003e https://github.com/npm/npm/issues/21202\n\n## Minimum weekly downloads\n\nUsage: `minWeeklyDownloads: 200`\n\nYou should always try to keep your external dependency list low and carefully consider if you need another dependency in your repo.\n\nEvery dependency you add to your project increases the attack surface and the risk of a supply chain attack.\n\nThis can help against accidentally installing a package with a typo-squatting name or a package that is not maintained anymore.\n\n## Usage\n\n\n### CLI\n```sh\n$ pnpm add package-policy\n$ package-policy --init .\n$ pnpm install\n```\n\n### Manual installation\n\nCreate `.pnpmfile.cjs` in your repo\n```js\nmodule.exports = {\n  hooks: {\n    async readPackage(pkg) {\n      try {\n          await require('package-policy').readPackage(pkg)\n      } catch (err) {\n        if (err.code !== 'MODULE_NOT_FOUND') throw err;\n      }\n      return pkg\n    }\n  } \n}\n```\n\n\n## `package-policy.yml`\n\n```yml\n# package-policy.yml\n\n# Packages must be at least 2 days old to protect against a recent takeover\nminPackageAge: 2d\n\n# Min weekly package downloads\nminWeeklyDownloads: 200\n\n# Exclude these packages from the package policy\nignore:\n    react: \"16.13.1\"\n```\n\n\u003e [!NOTE]\n\u003e See the [package-policy.yml](./package-policy.yml) in this repository\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwille%2Fpackage-policy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwille%2Fpackage-policy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwille%2Fpackage-policy/lists"}