Hardening the npm Supply Chain: Lifecycle Scripts, Release Cooldowns, Provenance and Trusted Publishing
Hardening the npm supply chain rests on three pillars: limiting install scripts with an allow list, letting new versions wait a few days, and removing publish tokens with trusted publishing. In this post we try npm 11 and 12's allowScripts policy, pnpm's allowBuilds and minimumReleaseAge, npm's min-release-age, npm audit signatures output and OIDC-based trusted publishing with real installs against a local registry.
8 Nov 2026
·
10 min
·
4
