Skip to content

Security: VlV-515/code-kit-vlv

Security

docs/security.md

Security

code-kit-vlv can add a safe npm .npmrc for Node/npm, Vite, Angular, and package projects.

# Suppress deprecation warnings and informational messages; show only real errors.
loglevel=error

# Hide the "packages are looking for funding" summary after install.
fund=true

# Keep npm audit enabled.
audit=true

# Block dependency lifecycle scripts such as postinstall/preinstall/install.
# This helps prevent compromised dependencies from executing arbitrary code.
# If a package fails to install or start, review this setting first.
ignore-scripts=true

# Save exact versions in package.json instead of ranges.
# This prevents future installs from silently resolving different versions.
save-exact=true

If .npmrc exists, unrelated settings are preserved. Missing security settings are added. Conflicting values are reported rather than changed silently.

There aren't any published security advisories