diff --git a/.gitignore b/.gitignore
index b0b314aa..1a17b2b6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,9 +8,6 @@
 .vscode/
 jsconfig.json
 
-# NPM file created by GitHub actions
-.npmrc
-
 # Xcode
 build/
 *.pbxuser
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 00000000..d21f7a7b
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,4 @@
+# Supply chain protection: only resolve package versions published at least 7 days ago.
+min-release-age=7
+min-release-age-exclude[]=expensify-common
+min-release-age-exclude[]=eslint-config-expensify