Check Npm

by grafana1ccacf29049fApache-2.0279 starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated today

Audit a JavaScript/TypeScript repo's npm, yarn, or pnpm configuration for supply-chain hardening: tool version, lifecycle scripts, unsafe dependency protocols, and minimum release age ≥3 days. Use when the user invokes /check-npm or asks to audit package manager security, lifecycle scripts, git dependencies, ignore-scripts, min-release-age, allow-git, approvedGitRepositories, strictDepBuilds, or blockExoticSubdeps in a Grafana plugin or JS/TS project.

Instructions onlySecurity

AI-generated overview

Read-only audit of npm, yarn, or pnpm configuration for supply-chain hardening in a JS/TS repository.

What it does: Performs a read-only audit of the workspace root of a JavaScript or TypeScript repository, checking the package manager version, whether lifecycle scripts are disabled, unsafe dependency protocols, and a minimum release age of at least three days. It produces a PASS/FAIL report table with the detected package manager and version, plus paste-ready configuration fixes for each failing check. It does not modify any files.
When to use it: Use when the user invokes /check-npm or asks to audit package manager security, lifecycle scripts, git dependencies, ignore-scripts, min-release-age, allow-git, approvedGitRepositories, strictDepBuilds, or blockExoticSubdeps in a Grafana plugin or JS/TS project.
Requirements: Requires a JavaScript/TypeScript project with a package.json at the workspace root, the relevant package manager CLI (npm, yarn, or pnpm) available to report its version, and shell tools such as jq, grep, and find. It ships no scripts; it is instructions only.

npm / yarn / pnpm supply-chain audit

Read-only audit of the workspace root. Do not modify any files.

0. Detect package manager

bash

test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }jq -r '.packageManager // "unset"' package.jsonls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || true

test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }jq -r '.packageManager // "unset"' package.jsonls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || true

If no package.json, stop. Priority: packageManager → lockfile → default npm.

1. Tool version

bash

npm --version    # required ≥ 11.15.0yarn --version   # required ≥ 4.14.0pnpm --version   # required ≥ 11.0.0

npm --version    # required ≥ 11.15.0yarn --version   # required ≥ 4.14.0pnpm --version   # required ≥ 11.0.0

Use semver comparison. Verify pinned packageManager meets threshold.

2. Lifecycle scripts disabled

bash

grep -E '^ignore-scripts=' .npmrc 2>/dev/nullgrep -E 'enableScripts:' .yarnrc.yml 2>/dev/nullgrep -E 'strictDepBuilds:|dangerouslyAllowAllBuilds:|allowBuilds:' pnpm-workspace.yaml 2>/dev/null

grep -E '^ignore-scripts=' .npmrc 2>/dev/nullgrep -E 'enableScripts:' .yarnrc.yml 2>/dev/nullgrep -E 'strictDepBuilds:|dangerouslyAllowAllBuilds:|allowBuilds:' pnpm-workspace.yaml 2>/dev/null

Manager	PASS	FAIL
npm	`.npmrc` has `ignore-scripts=true`	missing or `false`
yarn	`enableScripts: false` or key absent	`enableScripts: true`
pnpm ≥ 11	`strictDepBuilds` unset/`true`, `dangerouslyAllowAllBuilds` unset/`false`, and `allowBuilds` unset/`[]`	`strictDepBuilds: false`, `dangerouslyAllowAllBuilds: true`, or `allowBuilds` non-empty
pnpm 10	`.npmrc` `ignore-scripts=true` OR `strictDepBuilds: true`	neither

pnpm 11+ ignores script settings in .npmrc and package.json#pnpm. pnpm 10 / yarn edge cases: references/managers.md [blocked].

3. Unsafe dependency protocols

Registry:

bash

grep -E '^allow-git=' .npmrc 2>/dev/nullgrep -E 'approvedGitRepositories:' .yarnrc.yml 2>/dev/nullgrep -E 'blockExoticSubdeps:' pnpm-workspace.yaml 2>/dev/null

grep -E '^allow-git=' .npmrc 2>/dev/nullgrep -E 'approvedGitRepositories:' .yarnrc.yml 2>/dev/nullgrep -E 'blockExoticSubdeps:' pnpm-workspace.yaml 2>/dev/null

Scan workspace package.json files (dependencies, devDependencies, optionalDependencies, peerDependencies). Prefer workspace-member discovery (pnpm-workspace.yaml / root workspaces / lerna / rush) per references/protocols.md [blocked], then scan only those manifests. Fallback (may overmatch non-workspace manifests):

Safe values only: semver range, workspace:, patch:, npm: alias to semver. Flag everything else (git URLs, tarballs, user/repo shorthand, file:, link:, exec:, …) as path → name → value (protocol).

Manager	PASS	FAIL
npm	`allow-git=none` or `root`	missing or `all`
yarn	`approvedGitRepositories: []` or grafana-scoped list, or omitted with policy comment + clean scan	unsafe entries or broad allow-list
pnpm ≥ 11	`blockExoticSubdeps` unset/`true`	`false`
pnpm 10.x	`blockExoticSubdeps: true`	unset (default `false`) or `false`

Protocol detection order and yarn posture details: references/protocols.md [blocked].

4. Minimum release age ≥ 3 days

3 days = 4320 minutes. npm uses days; yarn and pnpm use minutes.

bash

grep -E '^min(imum)?-release-age=' .npmrc 2>/dev/nullgrep -E 'npmMinimalAgeGate:' .yarnrc.yml 2>/dev/nullgrep -E 'minimumReleaseAge:|minimumReleaseAgeStrict:' pnpm-workspace.yaml 2>/dev/null

grep -E '^min(imum)?-release-age=' .npmrc 2>/dev/nullgrep -E 'npmMinimalAgeGate:' .yarnrc.yml 2>/dev/nullgrep -E 'minimumReleaseAge:|minimumReleaseAgeStrict:' pnpm-workspace.yaml 2>/dev/null

Manager	PASS	FAIL
npm	`min-release-age` ≥ `3`	missing
yarn	`npmMinimalAgeGate` ≥ 4320 min	missing or below
pnpm ≥ 11	`minimumReleaseAge` ≥ `4320`	unset (default `1440`) or below
pnpm 10	`minimum-release-age` / `minimumReleaseAge` ≥ `4320`	missing

Flag minimumReleaseAgeStrict: false on pnpm 11.

5. Report

#	Check	Status	Detail
0	Package manager	(npm / yarn / pnpm)	version: x.y.z (pinned: y.y.y if set)
1	Tool version ≥ threshold	PASS / FAIL	`actual` vs `required`
2	Scripts disabled	PASS / FAIL	config line or "missing"
3	Unsafe dep protocols	PASS / FAIL	registry state + flagged entries
4	Min release age ≥ 3 days	PASS / FAIL	config + value

Use PASS / FAIL only — no emojis.

For each FAIL, one paste-ready fix:

yaml

# pnpm 11 — pnpm-workspace.yamlstrictDepBuilds: truedangerouslyAllowAllBuilds: falseallowBuilds: []minimumReleaseAge: 4320blockExoticSubdeps: true

# pnpm 11 — pnpm-workspace.yamlstrictDepBuilds: truedangerouslyAllowAllBuilds: falseallowBuilds: []minimumReleaseAge: 4320blockExoticSubdeps: true

More fixes (tool upgrades, yarn git allow-list, pnpm 10): references/fix-snippets.md [blocked].

If all PASS: "All checks passed." and stop.

Source and attribution

Source:grafana/skillsinskills/grafana-plugins/check-npmat commit1ccacf2

License: Apache-2.0

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from grafana/skills

React 19 Plugin Migration

grafana

Guides migration of a Grafana plugin to React 19 compatibility through ordered build, dependency and source-code steps.

Software Development279updated today

Plugin Bundle Size

grafana

Guides optimisation of Grafana app plugin bundle size using React.lazy, Suspense and webpack code splitting.

Software Development279updated today

Grafana Scenes

grafana

Builds Grafana plugin pages with the @grafana/scenes framework, covering scenes, panels, variables and drilldowns.

Software Development279updated today

Mimir

grafana

Guides standing up and operating Grafana Mimir for scalable, multi-tenant, long-term Prometheus and OTLP metrics storage.

DevOps & Cloud279updated today

K6 Trend Analysis

grafana

Analyze Grafana Cloud k6 test run trends over time. Detects slow metric drift (e.g., P95 latency creeping up while still passing thresholds), computes headroom to thresholds, flags anomalies, and recommends threshold tightening. Use when the user asks about test performance trends, wants to know if metrics are degrading, asks whether thresholds should be tightened, or wants a health check across recent runs for a specific test. Trigger on phrases like "how is my test trending", "is P95 getting worse", "check for performance regression", "should I tighten thresholds", "are my tests degrading", "show me trends for test X", "analyze my k6 test runs", or "is my test getting slower". Also trigger when a user asks to check all tests in a project -- run this skill once per test and synthesize.

Awaiting classification279updated today

K6 Test Maintenance

grafana

Maintains and improves existing k6 load-test scripts: threshold tightening, version migration, refactoring, and best-practice audits.

Software Development279updated today

Check Npm

npm / yarn / pnpm supply-chain audit

0. Detect package manager

1. Tool version

2. Lifecycle scripts disabled

3. Unsafe dependency protocols

4. Minimum release age ≥ 3 days

5. Report

Source and attribution

More from grafana/skills

React 19 Plugin Migration

Plugin Bundle Size

Grafana Scenes

Mimir

K6 Trend Analysis

K6 Test Maintenance

More in Security

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt

Secops Cases