# Public npm registry (not GitHub Packages — that's internal-pkg only)
registry=https://registry.npmjs.org/

# Prevent install scripts from running automatically — the most common
# supply chain attack vector (malicious postinstall). If a legitimate
# dependency needs a script, allowlist it explicitly below.
ignore-scripts=true

# Refuse to install any package version published less than 7 days ago.
# Most supply chain attacks are detected and pulled within this window.
# npm v11: min-release-age / Bun: --minimum-release-age
minimum-release-age=604800
