https://github.com/wille/package-policy
Package policies for Node.js repos to protect against supply chain attacks
https://github.com/wille/package-policy
dependencies node nodejs npm pnpm security supply-chain-security yarn
Last synced: 6 months ago
JSON representation
Package policies for Node.js repos to protect against supply chain attacks
- Host: GitHub
- URL: https://github.com/wille/package-policy
- Owner: wille
- Created: 2024-12-04T14:46:20.000Z (over 1 year ago)
- Default Branch: master
- Last Pushed: 2024-12-29T21:21:05.000Z (over 1 year ago)
- Last Synced: 2025-08-22T13:54:35.604Z (11 months ago)
- Topics: dependencies, node, nodejs, npm, pnpm, security, supply-chain-security, yarn
- Language: JavaScript
- Homepage:
- Size: 49.8 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
> [!NOTE]
> pnpm now has native support for [minimumReleaseAge](https://github.com/pnpm/pnpm/pull/9957) and this package is not needed
[](https://www.npmjs.com/package/package-policy)
[](https://www.npmjs.com/package/package-policy)
# package-policy
Setup a dependency policy for your Node.js repo to protect against supply chain attacks and malicious dependencies.
package-policy will scan your lockfile and the NPM registry and check if the dependencies are passing the policy. If a dependency does not pass, the command will fail and the user will have to manually whitelist the dependency.
## Features
## Minimum package version age
Usage: `minPackageAge: 2d`
Set a minimum age policy of included packages to guard against recently hijacked npm packages.
This has happened several times in the wild to popular packages and is commonly detected within hours of the package being published.
It's important to be aware that this is an realistic attack vector and that the most common of these could have been saved
Read more:
> https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident
> https://github.com/npm/npm/issues/21202
## Minimum weekly downloads
Usage: `minWeeklyDownloads: 200`
You should always try to keep your external dependency list low and carefully consider if you need another dependency in your repo.
Every dependency you add to your project increases the attack surface and the risk of a supply chain attack.
This can help against accidentally installing a package with a typo-squatting name or a package that is not maintained anymore.
## Usage
### CLI
```sh
$ pnpm add package-policy
$ package-policy --init .
$ pnpm install
```
### Manual installation
Create `.pnpmfile.cjs` in your repo
```js
module.exports = {
hooks: {
async readPackage(pkg) {
try {
await require('package-policy').readPackage(pkg)
} catch (err) {
if (err.code !== 'MODULE_NOT_FOUND') throw err;
}
return pkg
}
}
}
```
## `package-policy.yml`
```yml
# package-policy.yml
# Packages must be at least 2 days old to protect against a recent takeover
minPackageAge: 2d
# Min weekly package downloads
minWeeklyDownloads: 200
# Exclude these packages from the package policy
ignore:
react: "16.13.1"
```
> [!NOTE]
> See the [package-policy.yml](./package-policy.yml) in this repository