Check Npm

npm / yarn / pnpm supply-chain audit

Read-only audit of the workspace root. Do not modify any files.

0. Detect package manager

test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }jq -r '.packageManager // "unset"' package.jsonls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || true

If no package.json, stop. Priority: packageManager → lockfile → default npm.

1. Tool version

npm --version    # required ≥ 11.15.0yarn --version   # required ≥ 4.14.0pnpm --version   # required ≥ 11.0.0

Use semver comparison. Verify pinned packageManager meets threshold.

2. Lifecycle scripts disabled

grep -E '^ignore-scripts=' .npmrc 2>/dev/nullgrep -E 'enableScripts:' .yarnrc.yml 2>/dev/nullgrep -E 'strictDepBuilds:|dangerouslyAllowAllBuilds:|allowBuilds:' pnpm-workspace.yaml 2>/dev/null

pnpm 11+ ignores script settings in .npmrc and package.json#pnpm. pnpm 10 / yarn edge cases: references/managers.md [blocked].

3. Unsafe dependency protocols

Registry:

grep -E '^allow-git=' .npmrc 2>/dev/nullgrep -E 'approvedGitRepositories:' .yarnrc.yml 2>/dev/nullgrep -E 'blockExoticSubdeps:' pnpm-workspace.yaml 2>/dev/null

Scan workspace package.json files (dependencies, devDependencies, optionalDependencies, peerDependencies). Prefer workspace-member discovery (pnpm-workspace.yaml / root workspaces / lerna / rush) per references/protocols.md [blocked], then scan only those manifests. Fallback (may overmatch non-workspace manifests):

find . -name package.json -not -path '*/node_modules/*'

Safe values only: semver range, workspace:, patch:, npm: alias to semver. Flag everything else (git URLs, tarballs, user/repo shorthand, file:, link:, exec:, …) as path → name → value (protocol).

Protocol detection order and yarn posture details: references/protocols.md [blocked].

4. Minimum release age ≥ 3 days

3 days = 4320 minutes. npm uses days; yarn and pnpm use minutes.

grep -E '^min(imum)?-release-age=' .npmrc 2>/dev/nullgrep -E 'npmMinimalAgeGate:' .yarnrc.yml 2>/dev/nullgrep -E 'minimumReleaseAge:|minimumReleaseAgeStrict:' pnpm-workspace.yaml 2>/dev/null

Flag minimumReleaseAgeStrict: false on pnpm 11.

5. Report

Use PASS / FAIL only — no emojis.

For each FAIL, one paste-ready fix:

# npm — .npmrcignore-scripts=trueallow-git=nonemin-release-age=3

# pnpm 11 — pnpm-workspace.yamlstrictDepBuilds: truedangerouslyAllowAllBuilds: falseallowBuilds: []minimumReleaseAge: 4320blockExoticSubdeps: true

# yarn — .yarnrc.ymlnpmMinimalAgeGate: 4320

More fixes (tool upgrades, yarn git allow-list, pnpm 10): references/fix-snippets.md [blocked].

If all PASS: "All checks passed." and stop.