CS Fundamentals Trainer · JavaScript · Security

Which practices reduce supply-chain risk for a JavaScript project?

  1. Changing exact versions like `"4.17.21"` to ranges like `"^4.17.21"`
  2. Committing `package-lock.json` and installing with `npm ci` in CI
  3. Installing with `--ignore-scripts` and allowing lifecycle scripts only for packages that need them
  4. Running `npm audit`, which flags newly published malicious packages before any advisory exists
  5. Preferring packages with npm provenance and verifying with `npm audit signatures`

Difficulty: hard

Answer this question

Related questions