supply-chain-hardening
This skill adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability.
supply-chain-hardening adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability. This defense strategy delays package installation until a minimum release age is met, giving the security community time to identify and report malicious or compromised packages before they reach your codebase.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-25
supply-chain-hardening adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability. This defense strategy delays package installation until a minimum release age is met, giving the security community time to identify and report malicious or compromised packages before they reach your codebase.
Use it when
- supply-chain-hardening enables you to configure install-time cooldown to delay package installation until minimum release age is met.
- Yes, supply-chain-hardening includes the capability to scan packages for malware signatures before bypassing security cooldowns.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
jamditis/claude-skills-journalism/supply-chain-hardening · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How does supply-chain-hardening protect npm from supply chain attacks?
supply-chain-hardening adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability. This defense strategy delays package installation until a minimum release age is met, giving the security community time to identify and report malicious or compromised packages before they reach your codebase.
What is npm minimum release age cooldown and how do I configure it?
supply-chain-hardening enables you to configure install-time cooldown to delay package installation until minimum release age is met. This cooldown period acts as a buffer between a package's publication and when it can be installed in your environment. By setting a release age requirement, supply-chain-hardening helps defend against supply-chain attacks and compromised npm or bun packages by ensuring only packages that have existed long enough to be vetted are installed.
Can supply-chain-hardening scan packages for malware signatures before bypassing security cooldowns?
Yes, supply-chain-hardening includes the capability to scan packages for malware signatures before bypassing security cooldowns. This scanning layer adds an additional defense mechanism, allowing you to identify suspicious package behavior or known malware patterns before installation proceeds. When combined with the release-age cooldown, this two-layer approach significantly reduces the risk of installing compromised or malicious npm and bun packages.
How do I safely install newly published packages with supply-chain-hardening?
supply-chain-hardening supports a secure bypass workflow for urgent or fresh package installations. While the default behavior enforces a minimum release age cooldown to defend against supply-chain attacks, the skill provides controlled mechanisms to override this protection when necessary. Before bypassing security cooldowns for newly published packages, you can leverage supply-chain-hardening's malware scanning capabilities to verify package integrity, ensuring you have visibility into what you're installing.
What supply chain attack patterns should I understand when using supply-chain-hardening?
supply-chain-hardening helps you understand supply-chain attack patterns and threat model limitations by implementing release-age verification and malware scanning. Common attack vectors include compromised npm or bun packages, typosquatting, and malicious transitive dependencies. While supply-chain-hardening's install-time cooldown and pre-install scanning reduce exposure to many threats, it's important to recognize that no single defense is complete—the skill works best as part of a broader security hardening strategy.
Is supply-chain-hardening compatible with both npm and bun package managers?
Yes, supply-chain-hardening provides bun package security hardening alongside npm protection. You can configure install-time cooldown and malware scanning for both package managers, allowing you to defend against supply-chain attacks across your entire dependency ecosystem. The skill supports bun minimumReleaseAge configuration and npm release age requirements, giving you consistent security controls regardless of which package manager you use.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Supply-chain hardening
Defends a journalism toolchain against the dominant npm/bun supply-chain attack pattern: a maintainer account or CI pipeline is compromised, a malicious version ships, and machines install it before anyone notices. Recent example: the Mini Shai-Hulud TanStack attack (2026-05-11) compromised 84 versions across 42 @tanstack/* packages and exfiltrated AWS / GCP / Vault / GitHub / SSH credentials via a postinstall script.
The defense is layered and intentionally simple:
- Install-time cooldown — only install package versions older than N days (default 7). This is the primary defense. By the time the cooldown expires, the security community has almost always flagged a
(truncated - see the full file via the links below)
File tree — 1 file
security-toolkit/skills/supply-chain-hardening/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Configure install-time cooldown to delay package installation until minimum release age is met”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Protect your dependencies from supply-chain threats with automated detection of malicious install scripts and attack vectors. This skill equips AI agents with security rules and offline scanning capabilities to audit code integrity before packages are installed, eliminating the need for external security services.
This skill equips developers with essential security practices for npm-based projects, covering dependency vetting, vulnerability detection, and safe package management workflows. Gain actionable guidance on hardening your supply chain and mitigating common risks in the Node.js ecosystem.
This skill automates the process of updating project dependencies while prioritizing security against supply chain threats. It integrates seamlessly with Claude Code CLI to manage package upgrades safely and efficiently.
This skill automates the process of updating project dependencies, reducing the overhead of manual version management and compatibility checks. By integrating with your development workflow, it helps teams stay current with the latest package versions while maintaining stability and reducing technical debt.
This skill helps SAP developers detect and fix security weaknesses lurking in their project dependencies. By scanning your packages against known vulnerability databases, you can address supply chain risks before they reach production and keep your SAP applications hardened against emerging threats.
check-npm helps you systematically review package manager settings across npm, yarn, and pnpm to strengthen your project's supply-chain defenses. By analyzing configuration files and dependency practices, it surfaces misconfigurations that could expose your codebase to security risks. Use this skill to enforce hardening best practices and maintain a resilient software supply chain.
More skills bun-package-manager (MIT) · bun-tanstack-start (MIT)