Something went wrong. Try again.
Monorepo for Aesthetic.Computer aesthetic.computer
Something went wrong. Try again.
core .npmrc
1.1 kB · 19 lines
1234567891011121314151617181920# Supply-chain cooldown. Refuse any package version published less than 7 days# ago, so a compromised release has time to be caught and yanked before it can# reach a lockfile here. Every npm compromise of 2026 — axios (live 3 hours),# jscrambler (minutes), the TanStack and @antv waves — was pulled well inside# this window.## Requires npm >= 11.10. On older npm this key is silently IGNORED, not an# error: if `npm config get min-release-age` prints `undefined`, it is doing# nothing. This repo was on npm 10.9.8 when the line was added, so check before# trusting it.min-release-age=7# Deliberately NOT setting `ignore-scripts=true`. It reads like free hardening# and it is not: ffmpeg-static fetches its binary from an `install` script, and# without it backend/tape-to-mp4.mjs breaks in production. It has also stopped# being much of a defense — the Miasma worm fires from binding.gyp during# node-gyp builds, and later jscrambler variants moved to import-time execution# specifically to get around this flag. The cooldown above is the control that# actually pays for itself.