mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
22 lines
665 B
YAML
22 lines
665 B
YAML
|
name: npm
|
||
|
|
description: Profile for npm, extending npm-restrictive with npm environment variables
|
||
|
|
inherits: npm-restrictive
|
||
|
|
|
||
|
|
package_managers:
|
||
|
|
- npm
|
||
|
|
|
||
|
|
environment:
|
||
|
|
# The npm-restrictive base allows no environment variables. Re-allow only
|
||
|
|
# what npm needs for auth, registry config, and TLS.
|
||
|
|
#
|
||
|
|
# Accepted trade-off: a malicious JS package executed during install can read
|
||
|
|
# the npm publishing token below, but NOT yarn/bun tokens, PyPI tokens, AWS
|
||
|
|
# keys, or other cloud/secret-manager credentials, which remain scrubbed.
|
||
|
|
allow:
|
||
|
|
- NPM_TOKEN
|
||
|
|
- NPM_AUTH_TOKEN
|
||
|
|
- NODE_AUTH_TOKEN
|
||
|
|
- npm_config_*
|
||
|
|
- NPM_CONFIG_*
|
||
|
|
- NODE_EXTRA_CA_CERTS
|