Mitigate NPM supply chain attacks

[raohmaru]

Due to recent NPM supply chain attacks like the Sha1-Hulud and Sha1-Hulud: The Second Coming, projects can mitigate attacks by ignoring npm lifecycle scripts and using pinned versions of the npm dependencies, and then re-generate the package-lock-json file.

Ignoring Scrpts

Consider adding the flag --ignore-scripts to the build GitHub Actions to prevent the execution of npm lifecycle scripts (e.g., pre-install and post-install). Sha1-Hulud relies on these scripts to exfiltrate data and replicate itself in the host machine.

npm ci --ignore-scripts

(Note than npm-ci, ignore scripts is disabled by default).

Pinned Versions for Dependecies

Currently, the version number of the npm dependencies and devDependencies use the caret character (^) which will update minor and patch versions up to (but not) the next major version.

  "dependencies": {
    "@babel/core": "^7.26.7",
    "@babel/plugin-transform-runtime": "^7.25.9",
    "@babel/preset-env": "^7.26.7",
    "autoprefixer": "^10.4.20",
    ...
  },

Removing the caret character (^) will harden deployment processes and slightly stop the worm.

———
Yours truly,
Rawl