Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jamditis/supply-chain-hardening
Configure install-time cooldowns for npm/bun (minimum release age) and run a sandboxed pre-install scan when the cooldown has to be bypassed.
Passed 21 of 23 test cases with the skill, and 11 of 23 without it.
and 12 more in the full report
10 fixed11 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
I need to install `@types/node` on Bun 1.3 immediately despite the 7-day hold. Should I pass `--bypass-release-age` or `--no-minimum-release-age` to `bun add`?
| Checked | Without skill | With skill |
|---|---|---|
| recommends using minimum-release-age equal to 0 | Passed | Passed |
| pairs the bypass flag with script execution suppression | Missed | Passed |
The instructions your model reads when the skill loads.
Defends a journalism toolchain against the dominant npm/bun supply-chain attack pattern: a maintainer account or CI pipeline is compromised, a malicious version ships, and machines install it before anyone notices. Recent example: the Mini Shai-Hulud TanStack attack (2026-05-11) compromised 84 versions across 42 @tanstack/* packages and exfiltrated AWS / GCP / Vault / GitHub / SSH credentials via a postinstall script.
The defense is layered and intentionally simple:
bwrap/firejail/unshare so a malicious package can't escape the inspection.--ignore-scripts at install, postinstall is the #1 attack vector. Skip lifecycle scripts on every cooldown-bypass install.These three together would have blocked the Mini Shai-Hulud TanStack attack on a stock laptop with no human in the loop.
Verified config keys (npm v11+ and bun 1.3+):
| Manager | File | Key | Units | Exclusion key |
|---|---|---|---|---|
| npm | ~/.npmrc (or project .npmrc) | min-release-age | days | none yet, proposed in npm/cli#8994 |
| bun | ~/.bunfig.toml (or project bunfig.toml) | [install] minimumReleaseAge | seconds | [install] minimumReleaseAgeExcludes = [] (exact names, no globs) |
Minimal config:
# ~/.npmrc
min-release-age=7
# ~/.bunfig.toml
[install]
minimumReleaseAge = 604800 # 7 days
minimumReleaseAgeExcludes = []
Requires npm 11+. Older npm silently ignores unknown keys, so the config looks correct but does nothing. Check with npm --version and npm config get min-release-age (should echo 7, not null).
When the cooldown blocks an install you actually want:
test cases passed, vs 11 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.