name: npm
description: Profile for npm, extending npm-restrictive with npm environment variables
inherits: npm-restrictive

package_managers:
  - npm

environment:
  # The npm-restrictive base allows no environment variables. Re-allow only
  # what npm needs for auth, registry config, and TLS.
  #
  # Accepted trade-off: a malicious JS package executed during install can read
  # the npm publishing token below, but NOT yarn/bun tokens, PyPI tokens, AWS
  # keys, or other cloud/secret-manager credentials, which remain scrubbed.
  allow:
    - NPM_TOKEN
    - NPM_AUTH_TOKEN
    - NODE_AUTH_TOKEN
    - npm_config_*
    - NPM_CONFIG_*
    - NODE_EXTRA_CA_CERTS