Mitigate NPM supply chain attacks

[raohmaru]

Due to recent NPM supply chain attacks like the Sha1-Hulud and Sha1-Hulud: The Second Coming, projects can mitigate attacks by ignoring npm lifecycle scripts and using pinned versions of the npm dependencies, and then re-generate the package-lock-json file.

Ignoring Scrpts

Consider adding the flag --ignore-scripts to the build GitHub Actions to prevent the execution of npm lifecycle scripts (e.g., pre-install and post-install). Sha1-Hulud relies on these scripts to exfiltrate data and replicate itself in the host machine.

npm ci --ignore-scripts

(Note that npm-ci, ignore scripts is disabled by default).

Pinned Versions for Dependecies

Currently, the version number of the stylelint dependency is using the caret character (^) which will update minor and patch versions up to (but not) version 17.0.0.

  "devDependencies": {
    "stylelint": "^16.26.0"
  },

Removing the caret character (^) will harden deployment processes and slightly stop the worm.

———
Yours truly,
Rawl