mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
88 lines
1.7 KiB
YAML
88 lines
1.7 KiB
YAML
name: npm-restrictive
|
|
description: Restrictive sandbox policy for npm ecosystem (npm, pnpm, yarn, bun)
|
|
package_managers:
|
|
- npm
|
|
- pnpm
|
|
- yarn
|
|
- bun
|
|
|
|
filesystem:
|
|
allow_read:
|
|
- ${CWD}/**
|
|
- ${HOME}/.npmrc
|
|
- ${HOME}/.yarnrc
|
|
- ${HOME}/.yarnrc.yml
|
|
- ${HOME}/.bundle
|
|
- ${HOME}/.npm/**
|
|
- ${HOME}/.pnpm-store/**
|
|
- ${HOME}/.cache/pnpm/**
|
|
- ${HOME}/.cache/yarn/**
|
|
- ${HOME}/.yarn/cache/**
|
|
- ${HOME}/.bun/install/cache/**
|
|
- /usr/local/**
|
|
- /Library/**
|
|
- /System/Library/**
|
|
- /private/var/**
|
|
|
|
allow_write:
|
|
- ${CWD}/node_modules/**
|
|
- ${HOME}/.npm/**
|
|
- ${HOME}/.pnpm-store/**
|
|
- ${HOME}/.cache/pnpm/**
|
|
- ${HOME}/.cache/yarn/**
|
|
- ${HOME}/.yarn/cache/**
|
|
- ${HOME}/.bun/install/cache/**
|
|
- ${CWD}/package-lock.json
|
|
- ${CWD}/yarn.lock
|
|
- ${CWD}/pnpm-lock.yaml
|
|
- ${CWD}/bun.lockb
|
|
- ${TMPDIR}/**
|
|
|
|
deny_read:
|
|
- ${HOME}/.ssh/**
|
|
- ${HOME}/.aws/**
|
|
- ${HOME}/.gcloud/**
|
|
- ${HOME}/.kube/**
|
|
- "**/.env"
|
|
- "**/.env.*"
|
|
- ${HOME}/.docker/config.json
|
|
|
|
deny_write:
|
|
- ${HOME}/.ssh/**
|
|
- ${HOME}/.aws/**
|
|
- /etc/**
|
|
- /usr/**
|
|
- /bin/**
|
|
- /sbin/**
|
|
|
|
network:
|
|
allow_outbound:
|
|
- registry.npmjs.org:443
|
|
- registry.yarnpkg.com:443
|
|
- npm.pkg.github.com:443
|
|
- github.com:443
|
|
|
|
deny_outbound:
|
|
- "*:*"
|
|
|
|
process:
|
|
allow_exec:
|
|
- /usr/bin/node
|
|
- /usr/local/bin/node
|
|
- ${HOME}/.npm/**
|
|
- ${HOME}/.pnpm-store/**
|
|
- ${HOME}/.cache/pnpm/**
|
|
- ${HOME}/.cache/yarn/**
|
|
- ${HOME}/.yarn/cache/**
|
|
- ${HOME}/.bun/install/cache/**
|
|
- /usr/bin/git
|
|
- /usr/local/bin/git
|
|
- /bin/bash
|
|
- /bin/sh
|
|
- /usr/bin/env
|
|
|
|
deny_exec:
|
|
- /usr/bin/curl
|
|
- /usr/bin/wget
|
|
- /usr/bin/python*
|