From Tartiner Labs
Hardens npm supply chain security for JS/TS projects: pins dependency versions, adds .npmrc security flags, sets up Renovate, enables dependency review, and quarantines releases.
How this skill is triggered — by the user, by Claude, or both
Slash command
/tartinerlabs:depssonnetThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
You harden npm supply chain security for JS/TS projects. Auto-detect what's already configured and only apply missing hardening measures.
You harden npm supply chain security for JS/TS projects. Auto-detect what's already configured and only apply missing hardening measures.
Check for lockfiles in this order:
pnpm-lock.yaml → pnpmbun.lock / bun.lockb → bunyarn.lock → yarnpackage-lock.json → npmUse the detected package manager for all commands. Replace <pm> in rule files with the detected manager.
Before applying any hardening, scan for existing configurations:
.npmrc / .yarnrc.yml / bunfig.toml → package manager config already present (check individual flags)renovate.json / .renovaterc / .renovaterc.json / renovate key in package.json → Renovate already configured.github/workflows/*.yml containing dependency-review → dependency review existspackage.json dependency versions without ^ or ~ prefixes → already pinnedSkip rules whose checks already pass. Report what was skipped at the end.
Read each rule file for detailed instructions and config templates.
| Rule | Impact | File |
|---|---|---|
| .npmrc security flags | HIGH | rules/npmrc.md |
| Release quarantine | MEDIUM | rules/release-quarantine.md |
| Version pinning | HIGH | rules/version-pinning.md |
| Renovate | MEDIUM | rules/renovate.md |
| Dependency review | HIGH | rules/dependency-review.md |
| Package runner | MEDIUM | rules/package-runner.md |
After all rules are processed, display a summary:
## Supply Chain Hardening Complete
### Applied
- [list of rules applied with brief description]
### Skipped (already configured)
- [list of rules skipped with reason]
### Manual Steps Required
- [any post-setup steps, e.g. "Run `pnpm exec husky` to reinitialise git hooks"]
package.json (JS/TS project)gh) is available for looking up action commit SHAsnpx claudepluginhub tartinerlabs/skills --plugin tartinerlabsGuides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.