upstream/prometheus
1
0
Fork 0
mirror of https://github.com/prometheus/prometheus.git synced 2026-06-09 00:22:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

ui: add supply-chain hardening .npmrc (#18794)

Browse source 
Set ignore-scripts=true, allow-git=none, and min-release-age=3 to
harden npm installs against lifecycle script abuse, git-sourced
dependencies, and recently published packages.

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
This commit is contained in:
Julien 2026-05-29 14:28:10 +02:00 committed by GitHub
parent 27925e446c
commit 1dd4d3f6c3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
web/ui/.npmrc Normal file
View file

@ -0,0 +1,9 @@
ignore-scripts=true
# Prevent installing packages sourced directly from git. Such packages bypass
# registry integrity checks and can ship their own .npmrc that re-enables
# lifecycle scripts, silently defeating ignore-scripts above.
allow-git=none
# Require packages to be published for at least 3 days before they can be
# installed. This mitigates transient supply-chain attacks where a malicious
# package is published and quickly pulled in before the community can react.
min-release-age=3