From ef9476e8fa93b8f8a7997e40528ac46ce240bed0 Mon Sep 17 00:00:00 2001 From: Shuchang Zheng Date: Mon, 6 Jul 2026 20:15:52 -0700 Subject: [PATCH] security: add .npmrc ignore-scripts to skyvern-ts/client (#7094) Co-authored-by: Claude Opus 4.8 (1M context) Co-authored-by: Aaron Perez --- skyvern-ts/client/.npmrc | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 skyvern-ts/client/.npmrc diff --git a/skyvern-ts/client/.npmrc b/skyvern-ts/client/.npmrc new file mode 100644 index 000000000..5c429893e --- /dev/null +++ b/skyvern-ts/client/.npmrc @@ -0,0 +1,5 @@ +# Supply chain protection: do not run lifecycle scripts (preinstall, install, +# postinstall) on npm install. Blocks worms like "Shai-Hulud" from executing +# on a compromised dependency before we notice. If a package genuinely needs +# its install script, use @lavamoat/allow-scripts to allowlist it. +ignore-scripts=true