check-npm

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

npm / yarn / pnpm supply-chain audit

npm / yarn / pnpm 供应链审计

Read-only audit of the workspace root. Do not modify any files.

对工作区根目录进行只读审计。请勿修改任何文件。

0. Detect package manager

0. 检测包管理器

bash

test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }
jq -r '.packageManager // "unset"' package.json
ls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || true

If no

package.json

, stop. Priority:

packageManager

→ lockfile → default npm.

bash

test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }
jq -r '.packageManager // "unset"' package.json
ls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || true

如果不存在

package.json

，则停止操作。优先级：

packageManager

字段 → 锁文件 → 默认使用npm。

1. Tool version

1. 工具版本

bash

npm --version    # required ≥ 11.15.0
yarn --version   # required ≥ 4.14.0
pnpm --version   # required ≥ 11.0.0

Use semver comparison. Verify pinned

packageManager

meets threshold.

Manager	Minimum
npm	11.15.0
yarn	4.14.0
pnpm	11.0.0

bash

npm --version    # required ≥ 11.15.0
yarn --version   # required ≥ 4.14.0
pnpm --version   # required ≥ 11.0.0

使用语义化版本（semver）进行比较。验证固定的

packageManager

版本是否符合阈值要求。

包管理器	最低版本
npm	11.15.0
yarn	4.14.0
pnpm	11.0.0

2. Lifecycle scripts disabled

2. 生命周期脚本已禁用

bash

grep -E '^ignore-scripts=' .npmrc 2>/dev/null
grep -E 'enableScripts:' .yarnrc.yml 2>/dev/null
grep -E 'strictDepBuilds:|dangerouslyAllowAllBuilds:|allowBuilds:' pnpm-workspace.yaml 2>/dev/null

Manager	PASS	FAIL
npm	`.npmrc` has `ignore-scripts=true`	missing or `false`
yarn	`enableScripts: false` or key absent	`enableScripts: true`
pnpm ≥ 11	`strictDepBuilds` unset/ `true` , `dangerouslyAllowAllBuilds` unset/ `false` , and `allowBuilds` unset/ `[]`	`strictDepBuilds: false` , `dangerouslyAllowAllBuilds: true` , or `allowBuilds` non-empty
pnpm 10	`.npmrc` `ignore-scripts=true` OR `strictDepBuilds: true`	neither

pnpm 11+ ignores script settings in

.npmrc

and

package.json#pnpm

. pnpm 10 / yarn edge cases: references/managers.md.

bash

grep -E '^ignore-scripts=' .npmrc 2>/dev/null
grep -E 'enableScripts:' .yarnrc.yml 2>/dev/null
grep -E 'strictDepBuilds:|dangerouslyAllowAllBuilds:|allowBuilds:' pnpm-workspace.yaml 2>/dev/null

包管理器	通过	不通过
npm	`.npmrc` 中包含 `ignore-scripts=true`	缺失该配置或值为 `false`
yarn	`enableScripts: false` 或该配置项不存在	`enableScripts: true`
pnpm ≥ 11	`strictDepBuilds` 未设置/值为 `true` ， `dangerouslyAllowAllBuilds` 未设置/值为 `false` ，且 `allowBuilds` 未设置/值为 `[]`	`strictDepBuilds: false` 、 `dangerouslyAllowAllBuilds: true` ，或 `allowBuilds` 值非空
pnpm 10	`.npmrc` 中 `ignore-scripts=true` 或 `strictDepBuilds: true`	两者都不满足

pnpm 11+会忽略

.npmrc

和

package.json#pnpm

中的脚本设置。pnpm 10 / yarn的边缘情况：references/managers.md。

3. Unsafe dependency protocols

3. 不安全依赖协议

Registry:

bash

grep -E '^allow-git=' .npmrc 2>/dev/null
grep -E 'approvedGitRepositories:' .yarnrc.yml 2>/dev/null
grep -E 'blockExoticSubdeps:' pnpm-workspace.yaml 2>/dev/null

Scan workspace

package.json

files (

dependencies

devDependencies

optionalDependencies

peerDependencies

). Prefer workspace-member discovery (pnpm-workspace.yaml / root workspaces / lerna / rush) per references/protocols.md, then scan only those manifests. Fallback (may overmatch non-workspace manifests):

find . -name package.json -not -path '*/node_modules/*'

Safe values only: semver range,

workspace:

patch:

npm:

alias to semver. Flag everything else (git URLs, tarballs,

user/repo

shorthand,

file:

link:

exec:

, …) as

path → name → value (protocol)

Manager	PASS	FAIL
npm	`allow-git=none` or `root`	missing or `all`
yarn	`approvedGitRepositories: []` or grafana-scoped list, or omitted with policy comment + clean scan	unsafe entries or broad allow-list
pnpm ≥ 11	`blockExoticSubdeps` unset/ `true`	`false`
pnpm 10.x	`blockExoticSubdeps: true`	unset (default `false` ) or `false`

Protocol detection order and yarn posture details: references/protocols.md.

注册表检查：

bash

grep -E '^allow-git=' .npmrc 2>/dev/null
grep -E 'approvedGitRepositories:' .yarnrc.yml 2>/dev/null
grep -E 'blockExoticSubdeps:' pnpm-workspace.yaml 2>/dev/null

扫描工作区中的

package.json

文件（包括

dependencies

、

devDependencies

、

optionalDependencies

、

peerDependencies

）。优先根据references/protocols.md中的工作区成员发现规则（pnpm-workspace.yaml / 根工作区 / lerna / rush）进行扫描，仅检查这些清单文件。备选方案（可能会误匹配非工作区清单）：

find . -name package.json -not -path '*/node_modules/*'

仅允许安全值：语义化版本范围、

workspace:

、

patch:

、指向语义化版本的

npm:

别名。将所有其他类型（Git URL、压缩包、

user/repo

简写、

file:

、

link:

、

exec:

等）标记为

路径 → 名称 → 值（协议）

。

包管理器	通过	不通过
npm	`allow-git=none` 或 `allow-git=root`	缺失该配置或值为 `all`
yarn	`approvedGitRepositories: []` 或Grafana作用域列表，或未配置但带有策略注释且扫描结果无问题	存在不安全条目或宽泛的允许列表
pnpm ≥ 11	`blockExoticSubdeps` 未设置/值为 `true`	值为 `false`
pnpm 10.x	`blockExoticSubdeps: true`	未设置（默认值为 `false` ）或值为 `false`

协议检测顺序和yarn的配置细节：references/protocols.md。

4. Minimum release age ≥ 3 days

4. 最小发布时长≥3天

3 days = 4320 minutes. npm uses days; yarn and pnpm use minutes.

bash

grep -E '^min(imum)?-release-age=' .npmrc 2>/dev/null
grep -E 'npmMinimalAgeGate:' .yarnrc.yml 2>/dev/null
grep -E 'minimumReleaseAge:|minimumReleaseAgeStrict:' pnpm-workspace.yaml 2>/dev/null

Manager	PASS	FAIL
npm	`min-release-age` ≥ `3`	missing
yarn	`npmMinimalAgeGate` ≥ 4320 min	missing or below
pnpm ≥ 11	`minimumReleaseAge` ≥ `4320`	unset (default `1440` ) or below
pnpm 10	`minimum-release-age` / `minimumReleaseAge` ≥ `4320`	missing

Flag

minimumReleaseAgeStrict: false

on pnpm 11.

3天 = 4320分钟。npm使用天数；yarn和pnpm使用分钟。

bash

grep -E '^min(imum)?-release-age=' .npmrc 2>/dev/null
grep -E 'npmMinimalAgeGate:' .yarnrc.yml 2>/dev/null
grep -E 'minimumReleaseAge:|minimumReleaseAgeStrict:' pnpm-workspace.yaml 2>/dev/null

包管理器	通过	不通过
npm	`min-release-age` ≥ `3`	缺失该配置
yarn	`npmMinimalAgeGate` ≥ 4320分钟	缺失该配置或数值低于要求
pnpm ≥ 11	`minimumReleaseAge` ≥ `4320`	未设置（默认值为1440）或数值低于要求
pnpm 10	`minimum-release-age` / `minimumReleaseAge` ≥ `4320`	缺失该配置

如果pnpm 11中设置了

minimumReleaseAgeStrict: false

，则标记为不通过。

5. Report

5. 报告

#	Check	Status	Detail
0	Package manager	(npm / yarn / pnpm)	version: x.y.z (pinned: y.y.y if set)
1	Tool version ≥ threshold	PASS / FAIL	`actual` vs `required`
2	Scripts disabled	PASS / FAIL	config line or "missing"
3	Unsafe dep protocols	PASS / FAIL	registry state + flagged entries
4	Min release age ≥ 3 days	PASS / FAIL	config + value

Use

PASS

FAIL

only — no emojis.

For each FAIL, one paste-ready fix:

ini

undefined

序号	检查项	状态	详情
0	包管理器	(npm / yarn / pnpm)	版本：x.y.z（若已固定则显示：y.y.y）
1	工具版本≥阈值	PASS / FAIL	`实际版本` vs `要求版本`
2	脚本已禁用	PASS / FAIL	配置行或“缺失”
3	不安全依赖协议	PASS / FAIL	注册表状态 + 标记的条目
4	最小发布时长≥3天	PASS / FAIL	配置项 + 数值

仅使用

PASS

FAIL

标记状态 —— 请勿使用表情符号。

对于每一项不通过的检查，提供一个可直接复制粘贴的修复方案：

ini

undefined

npm — .npmrc

ignore-scripts=true allow-git=none min-release-age=3


```yaml

ignore-scripts=true allow-git=none min-release-age=3


```yaml

pnpm 11 — pnpm-workspace.yaml

strictDepBuilds: true dangerouslyAllowAllBuilds: false allowBuilds: [] minimumReleaseAge: 4320 blockExoticSubdeps: true


```yaml

strictDepBuilds: true dangerouslyAllowAllBuilds: false allowBuilds: [] minimumReleaseAge: 4320 blockExoticSubdeps: true


```yaml

yarn — .yarnrc.yml

npmMinimalAgeGate: 4320


More fixes (tool upgrades, yarn git allow-list, pnpm 10): [references/fix-snippets.md](references/fix-snippets.md).

If all PASS: "All checks passed." and stop.

npmMinimalAgeGate: 4320


更多修复方案（工具升级、yarn Git允许列表、pnpm 10）：[references/fix-snippets.md](references/fix-snippets.md)。

如果所有检查都通过：显示“所有检查已通过。”并停止操作。