Secure Dependencies provides actionable guidance and best practices to safeguard Node.js and pnpm repositories against software supply-chain attacks. It helps teams enforce frozen lockfiles in CI, configure PR-level vulnerability audits, restrict risky package lifecycle scripts using pnpm's onlyBuiltDependencies or ignore-scripts, and set clear review policies for new packages. Ideal for engineering teams seeking to prevent compromised dependencies, typosquatting attacks, and malicious postinstall execution without slowing down daily development workflows.
주요 기능
01Package vetting guidelines to catch typosquatting and unmaintained libraries
02Automated audit gating with configurable severity thresholds on pull requests
03Frozen lockfile validation for CI pipelines to prevent unverified updates
04Lifecycle script containment via ignore-scripts and trusted dependency builds
050 GitHub stars
06Production-only audit strategies to minimize noise and triage monorepo CVEs
사용 사례
01Establishing automated CI security gates for Node.js and pnpm repositories
02Mitigating malicious postinstall and lifecycle script execution risks in dependencies
03Setting clear onboarding guidelines for vetting newly added third-party packages