From 6be801bca1d391987711c881afd9cc646c0180a2 Mon Sep 17 00:00:00 2001 From: Dan Admin McCormick <124207373+danmcc-admin@users.noreply.github.com> Date: Tue, 9 Jun 2026 21:47:50 -0400 Subject: [PATCH 1/2] Add .npmrc with ignore-scripts and save-exact Security hardening: ignore-scripts prevents malicious install scripts from running during npm install, and save-exact pins dependency versions. Co-Authored-By: Claude Opus 4.8 --- .npmrc | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .npmrc diff --git a/.npmrc b/.npmrc new file mode 100644 index 00000000..7c6e3384 --- /dev/null +++ b/.npmrc @@ -0,0 +1,2 @@ +ignore-scripts=true +save-exact=true From c13c88b9662392d646588ae23a0f4ecb2e6d9aea Mon Sep 17 00:00:00 2001 From: Enes Kutay SEZEN Date: Wed, 10 Jun 2026 13:48:00 -0400 Subject: [PATCH 2/2] Update readme --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 9ade3501..8321548b 100644 --- a/README.md +++ b/README.md @@ -52,8 +52,11 @@ window.addEventListener('cio.client.search.getSearchResults.completed', (event) ## Development / npm commands ```bash +npm run prepare # one-time after cloning: install husky git hooks (pre-push lint) npm run lint # run lint on source code and tests npm run test # run tests npm run coverage # run tests and serves coverage reports from localhost:8081 npm run docs # output documentation to `./docs` directory ``` + +> **Note:** `.npmrc` sets `ignore-scripts=true` for supply-chain safety, so lifecycle scripts (including husky's hook installation) do not run automatically on `npm install`. Run `npm run prepare` once after cloning to enable the `pre-push` lint hook.