npm-supply-chain-security

by robinyves

Install this Skill

curl -fsSL -o npm-supply-chain-security.zip https://skill.seembox.com/api/v1/skills/npm-supply-chain-security/download && unzip npm-supply-chain-security.zip

Download npm-supply-chain-security.zip

SKILL.md About

# npm-supply-chain-security

## Description
Protect your JavaScript projects from npm supply chain attacks. Learn to identify malicious packages, implement trusted publishing, and use security heuristics to detect compromised dependencies.

## Implementation

NPM supply chain attacks have become increasingly common, with recent incidents affecting packages with millions of weekly downloads. The Axios attack in March 2026 demonstrated how leaked long-lived npm tokens can be exploited to publish malicious dependencies.

### Key Security Practices:
- **Trusted Publishing**: Configure GitHub Actions workflows as the only authorized publishers to npm
- **Release Verification**: Check for accompanying GitHub releases when new package versions are published
- **Dependency Monitoring**: Watch for newly published dependencies in established packages
- **Token Management**: Use short-lived, scoped tokens instead of long-lived global tokens

### Red Flags for Malicious Packages:
- New dependencies added to established packages
- Versions published without corresponding GitHub releases
- Freshly published dependency packages with suspicious names
- Unusual code patterns or obfuscated implementations

## Code Examples

### Example 1: Configure Trusted Publishing
```json
{
  "name": "your-package",
  "version": "1.0.0",
  "publishConfig": {
    "registry": "https://registry.npmjs.org/",
    "provenance": true
  },
  "scripts": {
    "release": "npm publish --provenance"
  }
}
```

### Example 2: GitHub Actions Workflow for Trusted Publishing
```yaml
name: Publish Package
on:
  release:
    types: [published]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # Required for trusted publishing
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'
      - run: npm ci
      - run: npm publish --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
```

### Example 3: Security Heuristic Checker
```python
import requests
import json

def check_package_release_heuristic(package_name, version):
    """Check if package version has corresponding GitHub release"""
    # Get package info from npm registry
    npm_url = f"https://registry.npmjs.org/{package_name}/{version}"
    npm_response = requests.get(npm_url)
    
    if npm_response.status_code != 200:
        return False, "Package version not found"
    
    npm_data = npm_response.json()
    repository = npm_data.get('repository', {}).get('url', '')
    
    if 'github.com' not in repository:
        return True, "Non-GitHub repository"  # Can't verify
    
    # Extract GitHub repo info
    repo_parts = repository.replace('https://github.com/', '').replace('.git', '').split('/')
    if len(repo_parts) != 2:
        return True, "Invalid repository format"
    
    owner, repo = repo_parts
    github_release_url = f"https://api.github.com/repos/{owner}/{repo}/releases/tags/v{version}"
    github_response = requests.get(github_release_url)
    
    if github_response.status_code == 200:
        return True, "GitHub release found"
    else:
        return False, "No corresponding GitHub release - potential red flag!"

# Usage
safe, message = check_package_release_heuristic("axios", "1.14.1")
print(f"Security check: {safe} - {message}")
```

### Example 4: Dependency Audit Script
```javascript
const fs = require('fs');
const path = require('path');

// Usage
const suspicious = auditDependencies('./package.json');
if (suspicious.length > 0) {
    console.warn('Suspicious dependencies detected:', suspicious);
}
```

## Dependencies
- Python 3.8+ (for security scripts)
- requests library
- Node.js 18+ (for npm workflows)
- GitHub CLI (optional, for automated verification)

_meta.json Metadata

{
  "ownerId": "kn7b9zhqs473t6aq6nms593jpd81ddwz",
  "publishedAt": 1775054364872,
  "slug": "npm-supply-chain-security",
  "version": "1.0.0"
}