rules-npm

'npm audit fix --force' can install breaking changes by upgrading across major versions. It may break your project in non-obvious ways.

Deprecating an npm package version affects all users who install or update that version. Confirm the deprecation message is accurate.

Installing a package directly from a URL or VCS reference bypasses npm registry integrity verification. The source may be unaudited, mutable, or non-reproducible.

'npm link' symlinks a local package into node_modules, bypassing normal version resolution. A development build can silently be injected into a dependency tree that expects a published version.

Publishing to npm is permanent (except within 72 hours). Verify the version, build output, and .npmignore before publishing.

Custom npm registry detected in .npmrc. Redirecting to a non-official registry can enable dependency confusion attacks if the private registry does not prevent public package shadowing.

Running a package with npx without a pinned version always fetches the latest release. A compromised maintainer account or hijacked package could execute malicious code in your project.

Install lifecycle script detected. postinstall/preinstall scripts run automatically on 'npm install' in any project that depends on this package — a common supply-chain attack vector.

Caret (^) and tilde (~) version ranges are banned. Use exact version pins (e.g., "1.2.3") to ensure reproducible installs across all environments.

Lockfiles must not be hand-edited. They are machine-generated. Run 'npm install' (or yarn/bun/pnpm equivalent) to regenerate after changing package.json.

npm unpublish is blocked. Removing published packages breaks anyone depending on that version and cannot be undone after 72 hours. Use 'npm deprecate' to discourage use without removing.

Hardcoded npm auth token detected in .npmrc. Tokens committed to source control expose registry credentials to anyone with repo access. Use environment variable substitution instead: //registry.npmjs.org/:_authToken=${NPM_TOKEN}

Plaintext password detected in .npmrc. Store credentials using 'npm login' or environment variables, never as a plaintext value in source control.

Wildcard version (*) in package.json resolves to whatever is latest at install time, making builds non-reproducible. Use an exact version.