Supply Chain Hardening (Grade B)Security-tested data-ai skill for Claude AI. Grade B. Configure install-time cooldowns for npm/bun (minimum release age) and run a sandboxed pre-install scan when the cooldown has to be bypassed. Use

Supply Chain Hardening (Grade B) is a security-tested data-ai skill for Claude AI that defends a journalism toolchain against npm/bun supply-chain attacks. It configures install-time cooldowns for npm/bun (minimum release age) and runs a sandboxed pre-install scan when the cooldown has to be bypassed. This skill is used to prevent attacks where a malicious package is installed before it's noticed, such as the Mini Shai-Hulud TanStack attack. The defense is layered and simple: install-time cooldown, sandboxed pre-install scan, and skipping lifecycle scripts on cooldown-bypass installs. The cooldown period is 7 days by default. The skill requires npm 11+ or bun 1.3+. The cooldown can be bypassed with --min-release-age=0 and --ignore-scripts flags for npm, and --minimum-release-age=0 and --ignore-scripts flags for bun. However, this requires a human-readable review of the package's postinstall script. Native modules that need postinstall can have the script run manually after review. The skill can be configured using ~/.npmrc or project .npmrc for npm, and ~/.bunfig.toml or project bunfig.toml for bun. The config keys are min-release-age for npm and minimumReleaseAge for bun. The pros of this skill include preventing supply-chain attacks, defending against malicious packages, and providing a layered defense. However, there are limitations to this skill. It may block legitimate installs if the cooldown period is too long. Additionally, the sandboxed pre-install scan may not catch all malicious packages. The skill has several features, including install-time cooldown, sandboxed pre-install scan, and skipping lifecycle scripts. Use cases for this skill include defending against supply-chain attacks, hardening against Shai-Hulud-class worms, and safely installing packages that were recently published.