JavaScript hardening overview

Navigation

Reference - Overview of the collected data
Config Generator - Generate (starter) config files based on the info in this overview
Explanation - Info about this project, the methodology used and other FAQ
GitHub - Source code & data repository
Sources - Links that aren't included elsewhere

General settings

Scopeprojectglobal

Toolsnpmyarn-classicyarn-berrypnpmbun-install

PrettifyAmount of newlines between config options:

CommentsAdd titlesAdd docs url

Minimum release age

in days. Example value (3 days): 3ddocs

in minutes. Example value (3 days): 4320docs

Block install scripts

Set to true to disable postinstall scriptsdocs

pnpm ignores install scripts by default. This checkbox enables strict mode, which makes pnpm exit when finding unforeseen scriptsdocs

Block git repo/tarball sources for indirect dependencies

When set to true, only direct dependencies may use exotic sourcesdocs

Don't install newer versions if security measures decreased

When set to no-downgrade, package installation will fail if a package's trust level has decreaseddocs

Limit plug & play to listed dependencies

By default, semi-strict node_modules are used in pnpmdocs

Anti-lockfile poisoning

Set to true to enable hardened mode: Yarn will query the remote registries to validate that the lockfile content matches the remote informationdocs