deps

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Language Conventions

语言规范

Infer language style from the project:

Analyse existing documentation, commit messages, and code comments to detect the project's language variant (US English, UK English, etc.)
Match the spelling conventions found in the project (e.g., "initialize" vs "initialise", "color" vs "colour")
Maintain consistency with the project's established language style throughout config files and comments

You harden npm supply chain security for JS/TS projects. Auto-detect what's already configured and only apply missing hardening measures.

从项目推断语言风格：

分析现有文档、提交信息和代码注释，识别项目使用的语言变体（美式英语、英式英语等）
匹配项目中使用的拼写规范（例如 "initialize" 与 "initialise"、"color" 与 "colour"）
在所有配置文件和注释中保持与项目既定语言风格的一致性

你负责为JS/TS项目加固npm供应链安全。自动检测已有配置，仅补充缺失的加固措施。

1. Detect Package Manager

1. 检测包管理器

Check for lockfiles in this order:

```
pnpm-lock.yaml
```
→ pnpm
```
bun.lock
```
/
```
bun.lockb
```
→ bun
```
yarn.lock
```
→ yarn
```
package-lock.json
```
→ npm
No lockfile → ask the user

Use the detected package manager for all commands. Replace

<pm>

in rule files with the detected manager.

按以下顺序检查锁文件：

```
pnpm-lock.yaml
```
→ pnpm
```
bun.lock
```
/
```
bun.lockb
```
→ bun
```
yarn.lock
```
→ yarn
```
package-lock.json
```
→ npm
无锁文件 → 询问用户

所有命令都使用检测到的包管理器。将规则文件中的

<pm>

替换为检测到的管理器名称。

2. Detect Existing Config

2. 检测现有配置

Before applying any hardening, scan for existing configurations:

```
.npmrc
```
/
```
.yarnrc.yml
```
/
```
bunfig.toml
```
→ package manager config already present (check individual flags)

renovate.json

.renovaterc

.renovaterc.json

renovate

key in

package.json

→ Renovate already configured

```
.github/workflows/*.yml
```
containing
```
audit
```
→ audit workflow exists

.github/workflows/*.yml

containing

dependency-review

→ dependency review exists

```
.github/workflows/*.yml
```
containing
```
lockfile
```
→ lockfile integrity check exists
```
package.json
```
dependency versions without
```
^
```
or
```
~
```
prefixes → already pinned

Skip rules whose checks already pass. Report what was skipped at the end.

在应用任何加固措施前，扫描现有配置：

```
.npmrc
```
/
```
.yarnrc.yml
```
/
```
bunfig.toml
```
→ 已存在包管理器配置（检查单个标识）

renovate.json

.renovaterc

.renovaterc.json

package.json

中的

renovate

字段 → 已配置Renovate

```
.github/workflows/*.yml
```
包含
```
audit
```
关键词 → 已存在审计工作流
```
.github/workflows/*.yml
```
包含
```
dependency-review
```
关键词 → 已存在依赖审查
```
.github/workflows/*.yml
```
包含
```
lockfile
```
关键词 → 已存在锁文件完整性检查
```
package.json
```
依赖版本没有
```
^
```
或
```
~
```
前缀 → 已完成版本锁定

跳过已满足检查条件的规则。 最后报告所有跳过的内容。

3. Apply Rules

3. 应用规则

Read each rule file for detailed instructions and config templates.

Rule	Impact	File
.npmrc security flags	HIGH	`rules/npmrc.md`
Release quarantine	MEDIUM	`rules/release-quarantine.md`
Version pinning	HIGH	`rules/version-pinning.md`
Renovate	MEDIUM	`rules/renovate.md`
Audit workflow	HIGH	`rules/audit-workflow.md`
Dependency review	HIGH	`rules/dependency-review.md`
Lockfile integrity	MEDIUM	`rules/lockfile-integrity.md`

阅读每个规则文件获取详细说明和配置模板。

规则	影响等级	文件
.npmrc安全标识	高	`rules/npmrc.md`
发布隔离	中	`rules/release-quarantine.md`
版本锁定	高	`rules/version-pinning.md`
Renovate	中	`rules/renovate.md`
审计工作流	高	`rules/audit-workflow.md`
依赖审查	高	`rules/dependency-review.md`
锁文件完整性	中	`rules/lockfile-integrity.md`

4. Output Summary

4. 输出总结

After all rules are processed, display a summary:

undefined

处理完所有规则后，展示总结：

undefined

Supply Chain Hardening Complete

供应链加固完成

Applied

已应用

[list of rules applied with brief description]

[已应用的规则列表及简要说明]

Skipped (already configured)

已跳过（已配置）

[list of rules skipped with reason]

[已跳过的规则列表及原因]

Manual Steps Required

需要手动执行的步骤

[any post-setup steps, e.g. "Run
```
pnpm exec husky
```
to reinitialise git hooks"]

undefined

[任何后续配置步骤，例如"Run
```
pnpm exec husky
```
to reinitialise git hooks"]

undefined

Assumptions

假设条件

Project has a
```
package.json
```
(JS/TS project)
Project is hosted on GitHub (for CI workflows)
GitHub CLI (
```
gh
```
) is available for looking up action commit SHAs
Git is initialised in the project

项目有
```
package.json
```
（JS/TS项目）
项目托管在GitHub上（用于CI工作流）
已安装GitHub CLI (
```
gh
```
) 可用于查询操作提交SHA
项目已初始化Git