Skip to content

feat(publish-npm): add Socket Firewall to block malicious package installs #133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PierreJeanjacquot merged 1 commit into from
Sep 1, 2026
+7 −0
Merged

feat(publish-npm): add Socket Firewall to block malicious package installs #133

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/publish-npm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,12 @@ jobs:
registry-url: ${{ inputs.registry }}
scope: ${{ inputs.scope }}

- name: Enable Socket Firewall
uses: SocketDev/action@be1f253a41351d59095f8d7f1425985097dd1054
with:
mode: firewall-free
shims: true

- name: Ensure npm version
if: ${{ !inputs.dry-run }}
run: |
Expand Down
1 change: 1 addition & 0 deletions publish-npm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ for the package scope, Node.js version, registry URL, and other options. The wor
- **Downloads Artifacts**: Downloads specified artifacts if needed. 📦
- **Checks Out Your Repository**: Retrieves your code. 📥
- **Sets Up Node.js**: Installs the specified Node.js version and configures the `.npmrc` file. ⚙️
- **Enables Socket Firewall**: Blocks installation of any package on npmjs.com confirmed as malware by Socket, for every subsequent npm/yarn/pnpm call in the job. 🛡️
- **Installs Dependencies**: Uses the specified install command (default: `npm ci`) to install the dependencies. 📦
- **Builds the Package**: Builds the package using the specified build command (default: `npm run build`). 🔨
- **Performs Type Checking**: Runs type checking if configured. 🔍
Expand Down