From be2a64a6706c261bce16129532a51fa76582389e Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Thu, 27 Aug 2026 16:56:27 +0200
Subject: [PATCH] feat(publish-npm): add Socket Firewall to block malicious
 package installs

Run Socket Firewall Free (SocketDev/action, mode firewall-free, shims enabled) right after setup-node, so every npm/yarn/pnpm call in the job is checked against Socket's confirmed-malware database before install, failing the job closed if Socket's API is unreachable; Free tier only covers registry.npmjs.org.
---
 .github/workflows/publish-npm.yml | 6 ++++++
 publish-npm/README.md             | 1 +
 2 files changed, 7 insertions(+)

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 54eda7d..a6a866f 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -108,6 +108,12 @@ jobs:
           registry-url: ${{ inputs.registry }}
           scope: ${{ inputs.scope }}
 
+      - name: Enable Socket Firewall
+        uses: SocketDev/action@be1f253a41351d59095f8d7f1425985097dd1054
+        with:
+          mode: firewall-free
+          shims: true
+
       - name: Ensure npm version
         if: ${{ !inputs.dry-run }}
         run: |
diff --git a/publish-npm/README.md b/publish-npm/README.md
index 9663f9b..8adb335 100644
--- a/publish-npm/README.md
+++ b/publish-npm/README.md
@@ -8,6 +8,7 @@ for the package scope, Node.js version, registry URL, and other options. The wor
 - **Downloads Artifacts**: Downloads specified artifacts if needed. 📦
 - **Checks Out Your Repository**: Retrieves your code. 📥
 - **Sets Up Node.js**: Installs the specified Node.js version and configures the `.npmrc` file. ⚙️
+- **Enables Socket Firewall**: Blocks installation of any package on npmjs.com confirmed as malware by Socket, for every subsequent npm/yarn/pnpm call in the job. 🛡️
 - **Installs Dependencies**: Uses the specified install command (default: `npm ci`) to install the dependencies. 📦
 - **Builds the Package**: Builds the package using the specified build command (default: `npm run build`). 🔨
 - **Performs Type Checking**: Runs type checking if configured. 🔍