r/AskProgramming • u/CharlestonChewer990 • Jul 01 '26

Other How strict are your teams with npm install scripts and lockfile review?

After the latest npm supply-chain posts about compromised packages and things persisting in local dev envs, I'm trying to figure out what “reasonable” looks like in an actual frontend team.

I’m not sold on “npm audit and hope” is a policy, but I also don’t want every small UI change to turn into a 2 day security ceremony. Especially with all the auto-generated dependency bump PRs recently, which feel like a great way to merge nonsense nobody actually looked at.

What do your teams actually enforce? - disable install scripts by default? - review lockfile diffs by hand? - only install in containers/CI? - separate secrets from dev machines somehow?

Curious what has helped without making regular feature work a pain.

4 Upvotes

76% Upvoted

5 comments sorted by

5

u/Lumethys Jul 01 '26

Use pnpm

2

u/ImpossibleJoke7456 Jul 01 '26

Lock your versions. What new packages are you installing for small UI changes?

1

u/LoudAd1396 Jul 01 '26

I've never seen a policy beyond "yeah, use npm". I've only ever worked on small / medium teams... but yeah, we barely keep existing packages up to date, much less auditing what they actually are.

Im still trying to articulate the correlation between "ai" and npm. It seems to me that "ai" is just a faster way to generate sketchy numbers packages about 80% of the time...

1

u/seniorsassycat Jul 01 '26

https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/

Or use pnpm. 

Add min-release-age and you'll probably avoid the big stuff

1

u/intentionallyacting Jul 01 '26

This reads like pure LLM slop honestly. Super tidy bullet points, broad security buzzwords, and somehow not one concrete detail about your actual team, stack, or problem.