- are younger than 48h (it will just provide an old version instead)
- have fewer than 5,000 weekly downloads
https://github.com/stack-auth/npm-daycare
This is in response to the recent supply chain attacks that shattered the JavaScript ecosystem [1]. It's likely not a problem that will go away any time soon, so we figured we'd build something to protect against it.
Doing this on the proxy layer means it will work across the entire system, as proxies are set globally. In the future, we could also add more filters to the proxy.
To get started, just run the Docker container:
docker run -d --rm --name npm-daycare -p 4873:4873 bgodil/npm-daycare
npm set registry http://localhost:4873/
pnpm config set registry http://localhost:4873/
yarn config set registry http://localhost:4873/
bun config set registry http://localhost:4873/
npm view @types/node # has recent updates
npm view pgmock # has <5,000 weekly downloads
You probably also shouldn't rely on this as your only line of defense. Curious to hear what you think!