[AAE-46514] - using by default ignore-scripts and have a trusted list for those who are trusted

2026-09-09 18:03:21 +00:00 · 2026-06-04 09:26:32 +01:00
parent faf9d3faac
commit 04e90f9333
5 changed files with 929 additions and 188 deletions
@@ -21,6 +21,20 @@ for full details on what you may need to install before using ADF.
 - [Node Version Manager](docs/tutorials/nvm.md)
 - [CORS guide](ALFRESCOCORS.md)

+## Installation
+
+```bash
+npm install   # or npm ci
+```
+
+This project has built-in supply chain attack protection. When you run `npm install`:
+
+1. All packages install with scripts disabled (via `.npmrc`)
+2. Security check runs against OSV + GitHub Advisory databases (109+ known threats)
+3. Only trusted packages (esbuild, nx, husky, etc.) get their scripts executed
+
+If a malicious package is detected, installation is blocked and `node_modules` is deleted.
+
 ## Components

 You can find the sources for all ADF components in the [`lib`](/lib) folder.