Skip to content

chore: add .npmrc with min-release-age to mitigate npm supply chain attacks - #179

Merged
katayama8000 merged 1 commit into
masterfrom
feature/152-min-release-age
Jul 28, 2026
Merged

chore: add .npmrc with min-release-age to mitigate npm supply chain attacks#179
katayama8000 merged 1 commit into
masterfrom
feature/152-min-release-age

Conversation

@mmktomato

@mmktomato mmktomato commented Jul 28, 2026

Copy link
Copy Markdown
Member

Closes #152

Summary

  • Added a .npmrc file with min-release-age=3.
  • This tells npm to only install package versions that were published at least 3 days ago.
  • It reduces the risk of a supply chain attack, since malicious versions are often published and used within hours of release, before they get caught.

…ttacks

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@mmktomato

Copy link
Copy Markdown
Member Author

@katayama8000
Can you review this PR? 🙇

@katayama8000

Copy link
Copy Markdown
Collaborator

@mmktomato Looks good.

@katayama8000 katayama8000 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

to me.

@katayama8000
katayama8000 merged commit da05af3 into master Jul 28, 2026
6 checks passed
@katayama8000
katayama8000 deleted the feature/152-min-release-age branch July 28, 2026 07:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Set min-release-age

2 participants