[PM-41467] set min-release-age (.npmrc)

[dangbert]

🎟️ Tracking

📔 Objective

Improve the (npm) supply chain security posture of this repo by making npm install refuse by default to install a dependency (or sub-dependency) that was published within the last 4 days (this is configurable).

Threat model: if any dependency is compromised with a new malicious release published in the last 4 days, AND the user is running npm >= 11.10.0, then npm will refuse to install the package by default.

(npm < 11.10.0 doesn't support this config and will allow the install without additional protections).

In the event of such a threat, the hope is that the community will catch it and delete the published release before the 4 day mark is hit.

references:

• https://github.com/npm/cli/releases/tag/v11.10.0
• feat: add min-release-age npm/cli#8965

📸 Screenshots

[CLAassistant]

All committers have signed the CLA.

[bitwarden-bot]

Thank you for your contribution! We've added this to our internal Community PR board for review.
ID: PM-41467
Link: https://bitwarden.atlassian.net/browse/PM-41467

Details on our contribution process can be found here: https://contributing.bitwarden.com/contributing/pull-requests/community-pr-process.