ossf/package-manager-best-practices

164 stars

Collection of security best practices for package managers.

✓ Synced 1h ago Share on X →

README badge:

[![ngmi](https://ngmi.review/badge/ossf/package-manager-best-practices.svg)](https://ngmi.review/repo/ossf/package-manager-best-practices)

21 Merged PRs

4 days Avg Merge Time

1m Fastest PR

19 days Slowest PR

      #594
      Global Speed Rank
    

PR Size Analysis

Lines changed (additions + deletions) vs review outcomes. Re-sync to populate data for older PRs.

PRs by size

Avg review time (hrs)

Clean approval rate (%)

#	Title	Author	Time	Reviews	Blocks
#36	Add initial section covering vuln disclosure	@darakian	14 days	2	✓
#38	docs: fix spelling issue for reproducible installs	@lirantal	51m	2	✓
#31	Fix grammatical and spelling errors on `npm.md`	@ran-dall	18 days	13	✓
#34	Use .gitkeep files to keep empty dirs.	@jeffmendoza	21.7h	2	✓
#29	Move NPM to published and add version	@jeffmendoza	19 days	1	✓
#32	swap order of lockfiles and vendoring dependencies	@MylesBorins	24m	2	✓
#33	s/GPG/ECDSA	@MylesBorins	20m	1	✓
#30	fix: Use lowercase `package-lock.json` for title	@erezrokah	3 days	2	✓
#28	Remove confusing reference to colors	@jeffmendoza	1m	1	✓
#27	Update recommendations on publishing packages.	@jeffmendoza	8 days	1	✓
#26	fix: use lowercase `package-lock.json`, fix shrinkwrap file link	@erezrokah	2.8h	2	✓
#25	Update recommendations for lockfiles	@laurentsimon	15 days	21	1×
#22	Change recommendations for needing CLI tool in automated environment.	@jeffmendoza	5 days	7	✓
#19	Clarify npm install	@jeffmendoza	8 days	2	✓
#16	Clarify uppercase characters	@jeffmendoza	7 days	4	✓
#17	Clarify vendoring issues	@jeffmendoza	23m	2	✓
#18	Clarify pinning and lockfile	@jeffmendoza	13m	2	✓
#5	Fix plural in dir names to match.	@jeffmendoza	1 day	1	✓
#4	Move npm document to review directory.	@jeffmendoza	19.3h	1	✓
#3	Publish draft of npm best practices guide	@jeffmendoza	2.1h	6	✓