Harden your machine against npm supply-chain worms with 3 config lines and an agent prompt
kesarito · x · 2026-10-27
The author shares a 3-line machine-wide config to defend against the next Shai-Hulud-style npm supply-chain worm: no package versions younger than 3 days, no install scripts, and no git deps pulled in transitively.
He published a gist with a ready-to-run hardening prompt for coding agents: detect the OS, inventory npm/pnpm/yarn/bun, then apply user-level settings—npm's min-release-age=3 + ignore-scripts + allow-git=root (needs npm≥11.10), pnpm's minimumReleaseAge: 4320 + blockExoticSubdeps (needs ≥10.16), bun's minimumReleaseAge=259200s (needs ≥1.3), yarn classic ignore-scripts, yarn berry enableScripts:false + npmMinimalAgeGate: 4320—and require each setting be proven with a real test.
More from coding & agent
- CEO says he hasn't opened Feishu for a week—Agents handle approvals, messages and email — FuSheng_0306 · 2026-10-27
- Anthropic engineer: build self-prompting agent systems, not single prompts — _AustinCalvert_ · 2026-10-27
- Cronjob that says "continue" every 45 minutes keeps your agent working — _AustinCalvert_ · 2026-10-27
- Anthropic open-sources sandbox-runtime to stop MCP servers reading your SSH keys and .env files — solyarisoftware · 2026-10-27
- Ant Group's Lingguang 2.0 relaunches as a proactive personal AI assistant — xiaohu · 2026-10-27
- Three open-source models sketch a desk-scale local agent loop: brain, voice, and eyes — lmoroney · 2026-10-27