Skill: robinyves/npm-supply-chain-security (version 1.0.0)

# npm-supply-chain-security ## Description Protect your JavaScript projects from npm supply chain attacks. Learn to identify malicious packages, implement trusted publishing, and use security heuristics to detect compromised dependencies. ## Implementation NPM supply chain attacks have become increasingly common, with recent incidents affecting packages with millions of weekly downloads. The Axios attack in March 2026 demonstrated how leaked long-lived npm tokens can be exploited to publish malicious dependencies. ### Key Security Practices: - **Trusted Publishing**: Configure GitHub Actions workflows as the only authorized publishers to npm - **Release Verification**: Check for accompanying GitHub releases when new package versions are published - **Dependency Monitoring**: Watch for newly published dependencies in established packages - **Token Management**: Use short-lived, scoped tokens instead of long-lived global tokens ### Red Flags for Malicious Packages: - New dependencies added to established packages - Versions published without corresponding GitHub releases - Freshly published dependency packages with suspicious names - Unusual code patterns or obfuscated implementations ## Code Examples ### Example 1: Configure Trusted Publishing ```json { "name": "your-package", "version": "1.0.0", "publishConfig": { "registry": "https://registry.npmjs.org/", "provenance": true }, "scripts": { "release": "npm publish --provenance" } } ``` ### Example 2: GitHub Actions Workflow for Trusted Publishing ```yaml name: Publish Package on: release: types: [published] jobs: publish: runs-on: ubuntu-latest permissions: contents: read id-token: write # Required for trusted publishing steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: '20' registry-url: 'https://registry.npmjs.org' - run: npm ci - run: npm publish --provenance env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} ``` ### Example 3: Security Heuristic Checker ```python import requests import json def check_package_release_heuristic(package_name, version): """Check if package version has corresponding GitHub release""" # Get package info from npm registry npm_url = f"https://registry.npmjs.org/{package_name}/{version}" npm_response = requests.get(npm_url) if npm_response.status_code != 200: return False, "Package version not found" npm_data = npm_response.json() repository = npm_data.get('repository', {}).get('url', '') if 'github.com' not in repository: return True, "Non-GitHub repository" # Can't verify # Extract GitHub repo info repo_parts = repository.replace('https://github.com/', '').replace('.git', '').split('/') if len(repo_parts) != 2: return True, "Invalid repository format" owner, repo = repo_parts github_release_url = f"https://api.github.com/repos/{owner}/{repo}/releases/tags/v{version}" github_response = requests.get(github_release_url) if github_response.status_code == 200: return True, "GitHub release found" else: return False, "No corresponding GitHub release - potential red flag!" # Usage safe, message = check_package_release_heuristic("axios", "1.14.1") print(f"Security check: {safe} - {message}") ``` ### Example 4: Dependency Audit Script ```javascript const fs = require('fs'); const path = require('path'); function auditDependencies(packageJsonPath) { const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')); const dependencies = {...packageJson.dependencies, ...packageJson.devDependencies}; // Check for recently published packages (simplified) const suspiciousPatterns = [ 'crypto-js', 'plain-', 'simple-', 'basic-', 'core-' ]; const suspiciousDeps = []; for (const [dep, version] of Object.entries(dependencies)) { // Check if dependency name matches suspicious patterns if (suspiciousPatterns.some(pattern => dep.includes(pattern))) { suspiciousDeps.push(dep); } } return suspiciousDeps; } // Usage const suspicious = auditDependencies('./package.json'); if (suspicious.length > 0) { console.warn('Suspicious dependencies detected:', suspicious); } ``` ## Dependencies - Python 3.8+ (for security scripts) - requests library - Node.js 18+ (for npm workflows) - GitHub CLI (optional, for automated verification)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)