supply-chain-hardening
This skill adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability.
supply-chain-hardening adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability. This defense strategy delays package installation until a minimum release age is met, giving the security community time to identify and report malicious or compromised packages before they reach your codebase.
AI-generated summary based on this skill's SKILL.md
Install
jamditis/claude-skills-journalism/supply-chain-hardening · repository language: Python
git clone https://github.com/jamditis/claude-skills-journalism
cp -r claude-skills-journalism/security-toolkit/skills/supply-chain-hardening ~/.claude/skills/supply-chain-hardeningFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How does supply-chain-hardening protect npm from supply chain attacks?
supply-chain-hardening adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability. This defense strategy delays package installation until a minimum release age is met, giving the security community time to identify and report malicious or compromised packages before they reach your codebase.
What is npm minimum release age cooldown and how do I configure it?
supply-chain-hardening enables you to configure install-time cooldown to delay package installation until minimum release age is met. This cooldown period acts as a buffer between a package's publication and when it can be installed in your environment. By setting a release age requirement, supply-chain-hardening helps defend against supply-chain attacks and compromised npm or bun packages by ensuring only packages that have existed long enough to be vetted are installed.
Can supply-chain-hardening scan packages for malware signatures before bypassing security cooldowns?
Yes, supply-chain-hardening includes the capability to scan packages for malware signatures before bypassing security cooldowns. This scanning layer adds an additional defense mechanism, allowing you to identify suspicious package behavior or known malware patterns before installation proceeds. When combined with the release-age cooldown, this two-layer approach significantly reduces the risk of installing compromised or malicious npm and bun packages.
How do I safely install newly published packages with supply-chain-hardening?
supply-chain-hardening supports a secure bypass workflow for urgent or fresh package installations. While the default behavior enforces a minimum release age cooldown to defend against supply-chain attacks, the skill provides controlled mechanisms to override this protection when necessary. Before bypassing security cooldowns for newly published packages, you can leverage supply-chain-hardening's malware scanning capabilities to verify package integrity, ensuring you have visibility into what you're installing.
What supply chain attack patterns should I understand when using supply-chain-hardening?
supply-chain-hardening helps you understand supply-chain attack patterns and threat model limitations by implementing release-age verification and malware scanning. Common attack vectors include compromised npm or bun packages, typosquatting, and malicious transitive dependencies. While supply-chain-hardening's install-time cooldown and pre-install scanning reduce exposure to many threats, it's important to recognize that no single defense is complete—the skill works best as part of a broader security hardening strategy.
Is supply-chain-hardening compatible with both npm and bun package managers?
Yes, supply-chain-hardening provides bun package security hardening alongside npm protection. You can configure install-time cooldown and malware scanning for both package managers, allowing you to defend against supply-chain attacks across your entire dependency ecosystem. The skill supports bun minimumReleaseAge configuration and npm release age requirements, giving you consistent security controls regardless of which package manager you use.
SKILL.md
rendered from the published skill — quoted content, verbatim
Supply-chain hardening
Defends a journalism toolchain against the dominant npm/bun supply-chain attack pattern: a maintainer account or CI pipeline is compromised, a malicious version ships, and machines install it before anyone notices. Recent example: the Mini Shai-Hulud TanStack attack (2026-05-11) compromised 84 versions across 42 @tanstack/* packages and exfiltrated AWS / GCP / Vault / GitHub / SSH credentials via a postinstall script.
The defense is layered and intentionally simple:
- Install-time cooldown — only install package versions older than N days (default 7). This is the primary defense. By the time the cooldown expires, the security community has almost always flagged a
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
security-toolkit/skills/supply-chain-hardening/SKILL.md