LavaMoat

https://lavamoat.github.io/
Admin
LavaMoat is a suite of tools for securing JavaScript projects against software supply chain attacks...
Tokens:29,492
Snippets:303
Trust Score:9.7
Update:1 month ago
Show doc for...
Tokens:
Raw
### Run allow-scripts setup

Source: https://lavamoat.github.io/guides/allow-scripts

Run the setup command in the project folder to initialize the allowlist without triggering an installation of other dependencies.

```bash
allow-scripts setup

```

--------------------------------

### Install @lavamoat/harden

Source: https://lavamoat.github.io/guides/harden

Install the tool globally, as a dev dependency, or run it directly via npx.

```bash
npm i -g @lavamoat/harden
npm i -D @lavamoat/harden
npx @lavamoat/harden
```

--------------------------------

### Configure setup lifecycle script in package.json

Source: https://lavamoat.github.io/guides/allow-scripts

Add a setup script to your package.json to handle post-install steps and additional post-processing commands.

```json
{
  "scripts": {
    "setup": "npm install && npm exec allow-scripts && tsc -b"
  }
}
```

--------------------------------

### Run hardening wizard

Source: https://lavamoat.github.io/guides/harden

Start the interactive wizard to apply hardening settings.

```bash
harden wizard
```

--------------------------------

### Install @lavamoat/allow-scripts globally

Source: https://lavamoat.github.io/guides/allow-scripts

Install the tool globally to avoid triggering installation of other dependencies before setup and allowlist are in place. Use the @lavamoat/ namespace in the package name.

```bash
npm i -g @lavamoat/allow-scripts

```

--------------------------------

### Install LavaMoat with npm

Source: https://lavamoat.github.io/guides/lavamoat-node

Use npm to install the LavaMoat runtime. Run this command in your project directory.

```bash
npm i lavamoat
```

--------------------------------

### Install LavaMoat with yarn

Source: https://lavamoat.github.io/guides/lavamoat-node

Alternative installation using yarn package manager.

```bash
yarn add lavamoat
```

--------------------------------

### Install Yarn plugin for allow-scripts

Source: https://lavamoat.github.io/guides/allow-scripts

Install the allow-scripts plugin for Yarn v3 or above via a public URL.

```bash
yarn plugin import https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js
```

--------------------------------

### Commit message summary examples

Source: https://lavamoat.github.io/contributor/contributing

Various examples of well-formatted commit message summaries.

```text
feat!(core): added default behavior


fix: semicolons no longer breaking everything


chore(webpack): upgrade to browserify v5
```

--------------------------------

### Install @lavamoat/webpack

Source: https://lavamoat.github.io/guides/webpack

Install the LavaMoat Webpack plugin as a dev dependency.

```bash
npm i -D @lavamoat/webpack
```

--------------------------------

### Mixed script composition example

Source: https://lavamoat.github.io/guides/harden-scripts

Example of a script composition that may require careful handling of permissions.

```json
"scripts": {
  "ci": "npm run lint && npm run test && vite build",
}
```

--------------------------------

### Compatibility-first scriptsConfig configuration

Source: https://lavamoat.github.io/guides/harden-scripts

Example of a compatibility-first approach where no default profile is set, allowing for granular control over specific scripts.

```json
"scripts": {
  "ci": "npm run lint && npm run test && npm run build",
  "lint": "eslint .",
  "test": "ava",
  "build": "vite build",
},
"scriptsConfig": {
  "lint": "lavamoat/scripts.strict.json",
  "test": "lavamoat/scripts.strict.json",
  "build": "lavamoat/scripts.loose.json"
}
```

--------------------------------

### Example Configuration for allowScripts

Source: https://lavamoat.github.io/guides/allow-scripts

Shows the structure of the lavamoat.allowScripts configuration in package.json. Keys are package names with optional version suffixes; values are booleans indicating whether lifecycle scripts are allowed. Items missing from the list will cause warnings.

```json
{
  "lavamoat": {
    "allowScripts": {
      "keccak#3.0.4": true,
      "rezeplayer>core-js#3.49.0": false,
      "some-package-denied-for-all-versions": false
    }
  }
}
```

--------------------------------

### Security-first scriptsConfig configuration

Source: https://lavamoat.github.io/guides/harden-scripts

Example of a security-first approach using a #default profile for most scripts and specific overrides for others.

```json
{
  "scripts": {
    "lint": "eslint .",
    "test": "ava",
    "build": "vite build",
    "release": "node scripts/release.mjs"
  },
  "scriptsConfig": {
    "#default": "lavamoat/scripts.strict.json",
    "build": "lavamoat/scripts.loose.json",
    "release": "lavamoat/scripts.release.json"
  }
}
```

--------------------------------

### Decisions snapshot JSON format

Source: https://lavamoat.github.io/guides/harden

Example of a JSON file used for saving or loading hardening decisions.

```json
{
  "n_engines": true,
  "n_scripts": "n_allowscripts",
  "n_git": true,
  "n_strictgit": false,
  "n_filterenv": true
}
```

--------------------------------

### Granting Access to Resources in policy-override.json

Source: https://lavamoat.github.io/guides/policy

This example grants the entropoetry package access to the global URL class and the entire buffer builtin.

```json
{
  "resources": {
    "some-package>entropoetry": {
      "globals": {
        "URL": true
      }
    },
    "some-package>entropoetry>bn.js": {
      "builtin": {
        "buffer": true
      }
    }
  }
}
```

--------------------------------

### Example LavaMoat policy.json

Source: https://lavamoat.github.io/guides/policy

This policy file defines access permissions for a dependency tree where some-package depends on entropoetry, which in turn depends on bn.js.

```json
{
  "resources": {
    "some-package": {
      "globals": {
        "Buffer.from": true
      },
      "packages": {
        "some-package>entropoetry": true
      }
    },
    "some-package>entropoetry": {
      "builtin": {
        "assert": true,
        "buffer.Buffer": true,
        "zlib": true
      },
      "globals": {
        "console": true,
        "process.exitCode": "write"
      },
      "packages": {
        "some-package>entropoetry>bn.js": true
      }
    },
    "some-package>entropoetry>bn.js": {
      "builtin": {
        "buffer.Buffer": true
      },
      "globals": {
        "Buffer": true
      }
    }
  }
}
```

--------------------------------

### Complex Property Access Configuration

Source: https://lavamoat.github.io/guides/policy

An example demonstrating how to allow specific nested properties while excluding others by defining the deepest chain of properties.

```json

  "globals": {
    "a": true,
    "a.b": false,
    "a.b.c": true
  }


```

--------------------------------

### Install @lavamoat/allow-scripts as project-local dev dependency

Source: https://lavamoat.github.io/guides/allow-scripts

Install as a project-local development dependency to enable contributors to execute allowed scripts. Note that this installation may trigger installation of other dependencies.

```bash
npm i -D @lavamoat/allow-scripts

```

```bash
yarn add -D @lavamoat/allow-scripts

```

```bash
pnpm add -D @lavamoat/allow-scripts

```

--------------------------------

### Check configuration with levels

Source: https://lavamoat.github.io/guides/harden

Verify configuration against specific hardening levels.

```bash
harden check --level moderate
harden check -p yarn -l strict
```

--------------------------------

### List configured packages with npm

Source: https://lavamoat.github.io/guides/allow-scripts

Print information about configured packages and potential changes using the list command with npm.

```bash
npm exec allow-scripts list
```

--------------------------------

### Apply hardening defaults

Source: https://lavamoat.github.io/guides/harden

Apply default hardening settings to the project.

```bash
harden defaults
```

--------------------------------

### Commit message without scope

Source: https://lavamoat.github.io/contributor/contributing

Example of a commit message when the change affects all projects.

```text
chore: update keywords in package.json files
```

--------------------------------

### Use decisions snapshot

Source: https://lavamoat.github.io/guides/harden

Commands to run the wizard or defaults using a decisions snapshot file.

```bash
harden wizard -s
harden defaults -d ./decisions-snapshot.json
```

--------------------------------

### Commit message with multiple scopes

Source: https://lavamoat.github.io/contributor/contributing

Example of a commit message affecting multiple projects.

```text
fix(core,node): fix a bug in lavamoat-core and lavamoat-node
```

--------------------------------

### Run tests

Source: https://lavamoat.github.io/contributor/contributing

Command to execute the project test suite.

```bash
npm test
```

--------------------------------

### Commit message with scope

Source: https://lavamoat.github.io/contributor/contributing

Example of a commit message including a scope for a specific package.

```text
chore(webpack): frobnicate the widget
```

--------------------------------

### List configured packages with Yarn

Source: https://lavamoat.github.io/guides/allow-scripts

Print information about configured packages and potential changes using the list command with Yarn.

```bash
yarn allow-scripts list
```

--------------------------------

### Conventional Commit message format

Source: https://lavamoat.github.io/contributor/contributing

An example of a commit message following the Conventional Commits convention.

```text
tag: Short description of what you did


Longer description here if necessary


Fixes #1234
```

--------------------------------

### Harden CLI options

Source: https://lavamoat.github.io/guides/harden

Available options for the harden command.

```text
Options:
  -p, --package-manager <pm>  Package manager to harden (npm, yarn, pnpm)
  -l, --level <level>         Hardening level: baseline, moderate, strict  [default: moderate]
  -d, --decisions-snapshot <file>  Path to decisions snapshot file (JSON) to apply regardless of level set
  -s, --save-decisions  Save decisions snapshot to ./decisions-snapshot.json at end of run (useful as a template to edit and re-use)
```

--------------------------------

### Check current configuration

Source: https://lavamoat.github.io/guides/harden

Run the check command to verify current configuration against hardening levels.

```bash
harden check
```

--------------------------------

### Unsupported Deny-list Configuration

Source: https://lavamoat.github.io/guides/policy

An example of an unsupported policy configuration where a sub-property is set to false after the parent is set to true.

```json

  "globals": {
    "a": true,
    "a.b": false
  }


```

--------------------------------

### Restrict globals in policy-override.json

Source: https://lavamoat.github.io/guides/policy-diff

Example of disabling powerful APIs like 'fetch' and 'process' for a package in the policy override file.

```json
"fetch": false,
"process": false
```

--------------------------------

### Wizard options

Source: https://lavamoat.github.io/guides/harden

Available options for the wizard command.

```text
Options:
  -p, --package-manager <pm>  Package manager to harden (npm, yarn, pnpm)
  -d, --decisions-snapshot <file>  Path to decisions snapshot file (JSON) to pre-fill wizard
  -s, --save-decisions  Save decisions snapshot to ./decisions-snapshot.json at end of run
```

--------------------------------

### Override process globals for granular access

Source: https://lavamoat.github.io/guides/policy-diff

Example of restricting the 'process' global while explicitly allowing 'process.env' in the policy override file.

```json
"globals": {
    "process": false,
    "process.env": true
  }
```

--------------------------------

### Correct Allow-list Configuration

Source: https://lavamoat.github.io/guides/policy

The recommended approach for defining access by explicitly listing the allowed properties.

```json

  "globals": {
    "a.c": true,
    "a.d": true
  }


```

--------------------------------

### Apply hardening defaults with specific level

Source: https://lavamoat.github.io/guides/harden

Apply hardening settings using the strict level.

```bash
harden defaults --level strict
```
Tokens:
Raw