add npmrc

Author: modelorona

.npmrc

@@ -0,0 +1,32 @@
+# Security settings for pnpm/npm
+# Enforces supply chain security best practices
+
+# Enforce official registry (prevent typosquatting via alternate registries)
+registry=https://registry.npmjs.org/
+
+# Require lock file to be up-to-date (fail if package.json doesn't match lock)
+prefer-frozen-lockfile=true
+
+# Strict SSL validation
+strict-ssl=true
+
+# Fail on missing or invalid peer dependencies
+strict-peer-dependencies=true
+
+# Pin exact versions when adding new dependencies
+save-exact=true
+
+# Audit level - fail on high/critical vulnerabilities
+audit-level=high
+
+# Disable lifecycle scripts (preinstall, postinstall, etc.) to prevent arbitrary code execution
+ignore-scripts=true
+
+# Verify integrity of packages in the store before linking to node_modules
+verify-store-integrity=true
+
+# Validate that the correct package manager is being used
+package-manager-strict=true
+
+# Delay installation of packages published less than 7 days ago
+minimum-release-age=10080