@lavamoat/harden

A tool for applying security-hardening defaults to your project's package manager configuration.

[!NOTE] This is an early preview of the package versioned 0.x. Changes planned:

• the composition of opinions included in each hardening level may change
• the CLI visuals and interactions to improve
• with the release of yarn6 new major changes are to be expected.

Install

Get the harden CLI tool somehow:

npm i -g @lavamoat/harden
npm i -D @lavamoat/harden
npx @lavamoat/harden

Usage

@lavamoat/harden writes opinionated security settings into your project's package manager config files (.npmrc, .yarnrc.yml, pnpm-workspace.yaml, package.json). It only modifies security-relevant keys and preserves everything else.

harden defaults - applies the hardening by level

harden wizard - interactively applies the hardening by asking questions

Apply defaults

harden defaults

Detects the package manager in use and writes hardening config at the moderate level (recommended for most projects). Pass --level to adjust:

| Level | What it covers | | ---------- | ------------------------------------------------------------------- | | baseline | Disables lifecycle scripts, blocks git deps, sets release age gate | | moderate | Everything in baseline + enforces minimum package manager version | | paranoid | Everything in moderate + additional settings for the extra cautious |

harden defaults --level paranoid

Override the detected package manager with --package-manager (-p):

harden defaults -p yarn --level baseline

Options

Options:
  -p, --package-manager <pm>  Package manager to harden (npm, yarn, pnpm)
  -l, --level <level>         Hardening level: baseline, moderate, paranoid  [default: moderate]
  -h, --help                  Show help
  -v, --version               Show version

Wizard

harden wizard

Assess your project and interactively apply hardening settings. The wizard will ask questions about your project and apply selected changes.

Opinions

This package comes with opinions about:

• package manager versions
• what's allowed to install and run at install time
• lesser known security-relevant settings
• cutting-edge tools to prevent certain classes of supply chain attacks