fix(security): harden npm plugin and hook install integrity flow

2026-02-19 15:10:57 +01:00
parent 2777d8ad93
commit 5dc50b8a3f
23 changed files with 1047 additions and 183 deletions
--- a/src/test-utils/exec-assertions.ts
+++ b/src/test-utils/exec-assertions.ts
@@ -28,7 +28,7 @@ export function expectSingleNpmPackIgnoreScriptsCall(params: {
    throw new Error("expected npm pack call");
  }
  const [argv, options] = packCall;
-  expect(argv).toEqual(["npm", "pack", params.expectedSpec, "--ignore-scripts"]);
+  expect(argv).toEqual(["npm", "pack", params.expectedSpec, "--ignore-scripts", "--json"]);
  const commandOptions = typeof options === "number" ? undefined : options;
  expect(commandOptions).toMatchObject({ env: { NPM_CONFIG_IGNORE_SCRIPTS: "true" } });
 }