Good laptop hygiene for package managers comes down to six habits: install from lockfiles, restrict install scripts, verify what you download, keep tokens narrow and short lived, open unfamiliar code in a restricted editor mode, and store credentials in a keychain. Each has vendor documentation behind it, linked below.
1. Install from the lockfile
Use npm ci after cloning or pulling, which fails if package.json and the lockfile disagree. In Rust, build with the locked flag. In Python, pin requirements and consider hash-checking mode. In Go, run go mod verify after restoring a cache.
2. Restrict install scripts
Set ignore-scripts for npm, or use pnpm 10, which disables dependency postinstall scripts by default. Allow builds for named packages only, after reading what they do. For Python, the only-binary option refuses source builds.
3. Verify what you download
- npm audit signatures verifies registry signatures and provenance attestations.
- pip hash-checking mode rejects files that do not match recorded hashes.
- Corepack can pin the package manager itself with a hash in the packageManager field.
Remember these prove origin and consistency. They do not prove the code is harmless.
4. Delay and constrain updates
A minimum release age in pnpm and an exclude-newer date in uv keep brand new uploads out of your resolution for a while. Blocking exotic transitive sources such as git URLs and tarballs closes another gap. Keep exceptions short and written down.
5. Keep tokens small and expiring
npm supports only granular tokens now. Scope to packages, set an expiry, limit by IP range, keep read-only where you can, and leave Bypass 2FA off. Stage-only tokens suit automation. Delete tokens you do not recognize.
6. Treat editors and extensions as code
VS Code opens unfamiliar folders in Restricted Mode, which disables tasks, the terminal, debugging, agents and many settings until you trust the folder. Extensions run with the editor's permissions, so check the publisher and prefer fewer of them.
7. Store credentials properly
Use an operating system keychain helper for Git instead of the store helper. Configure a credential store for Docker, since otherwise logins are base64 encoded in config.json. Do not paste tokens into remote URLs or dotfiles.
A one page version
- Install from lockfiles. Review lockfile diffs.
- Scripts off by default, allow by name.
- Verify signatures and hashes where available.
- Wait a day or more before adopting new releases.
- Tokens: narrow, expiring, listed.
- Restricted Mode for unknown code.
- Keychain for credentials.
- Rehearse revocation once.
What the checklist cannot do
It lowers the chance that a bad package runs on your machine. It does not tell you whether the packages you already use contain vulnerabilities, or which of those matter. For that you need an inventory of dependencies and regular scanning. Safeguard offers SBOM and dependency scanning for that job, and there is a free scan at gold.safeguard.sh/scan.
Click through it at your own pace, or open it full screen.
Quick check
Which habit gives the most protection for the least effort?
Installing from lockfiles and turning off dependency install scripts by default. Both are one time settings that change what runs on your machine.
How often should I review this?
Review tokens and exceptions monthly, and re-check tool settings whenever you upgrade a package manager.
Sources
- npm ci documentation
- npm config reference
- npm audit documentation
- npm, About access tokens
- pnpm, Mitigating supply chain attacks
- pip, Secure installs
- uv, Resolution concepts
- Go Modules Reference
- Cargo build reference
- Corepack README
- VS Code Workspace Trust
- VS Code extension runtime security
- Git gitcredentials
- Docker login
Last reviewed: 19 October 2026.
