From 3f7678a977b7018018a39cde4a476b659e5f0300 Mon Sep 17 00:00:00 2001 From: Justin Stayton Date: Tue, 6 Oct 2026 06:21:42 -0400 Subject: [PATCH] Require approval for dependency install scripts An install now fails on any dependency with an install script that hasn't been reviewed. None has one today, so there's nothing to approve yet. npm 11.19+ enforces it; npm 10 (Node 22) warns about an unknown config and ignores it. Co-Authored-By: Claude Opus 5.5 --- .npmrc | 1 + AGENTS.md | 9 +++++++++ 2 files changed, 10 insertions(+) create mode 100644 .npmrc diff --git a/.npmrc b/.npmrc new file mode 100644 index 0000000..4a6e0c1 --- /dev/null +++ b/.npmrc @@ -0,0 +1 @@ +strict-allow-scripts=true diff --git a/AGENTS.md b/AGENTS.md index ad81f4c..086962b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -25,6 +25,15 @@ code in this repository. CommonJS module (`"main": "./src/main.js"`, no build step). Node `>=22` is required. +`.npmrc` sets `strict-allow-scripts`, so an install fails on any dependency with +an install script that hasn't been reviewed. None has one today, so +`package.json` has no `allowScripts` field yet. If a new dependency needs one, +read what the script does, then add it with `npm approve-scripts ` (pinned +to the reviewed version), or `npm deny-scripts ` when it isn't needed — +never `npm approve-scripts --all` or `--dangerously-allow-all-scripts`. It's +enforced by npm 11.19+ (Node 24 and later); Node 22's npm 10 ignores it with an +"Unknown project config" warning. + ## Architecture This is a small published library (`@truepic/webhook-verifier`) that verifies