archetech / archon / 25751722087

95%

push

github

chore: add npm supply-chain protections (min release age, dep-review) (#518)

Defense against Shai-Hulud-class worm attacks: refuse fresh package
versions until they have had time to be flagged and unpublished.

- .npmrc: minimum-release-age=4320 (72h) — requires npm 11.5.1+
- .gitignore: track repo-root .npmrc, keep ignoring child .npmrc files
- dependabot: weekly + 3-day cooldown to match
- dependency-review action: fail-on-severity moderate (was high)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2028 of 2245 branches covered (90.33%)

Branch coverage included in aggregate %.

4298 of 4419 relevant lines covered (97.26%)

1153.71 hits per line