Supply chain prevention checklist for teams that only consume packages

If your team consumes packages and does not publish any, focus on what enters your builds: pin sources, commit lockfiles, review dependency changes, delay brand new releases, limit what install steps can run and prepare a response. Ten checks cover most of the exposure.

The checklist

1. Know your sources. Write down every registry and mirror your builds can reach. Pip's documentation states that when several indexes are configured there is no priority among them, and the best matching version is chosen. More sources mean more ways to fetch the wrong package.
2. Commit lockfiles and install from them in CI, so a build fetches exactly what you reviewed.
3. Use hash checking where the tool supports it. Pip's secure installs guide describes hash-checking mode with the require-hashes option as protection against remote tampering.
4. Review dependency changes in every pull request. GitHub's dependency review shows added, removed and updated dependencies, release dates and known vulnerabilities.
5. Wait a short time before adopting new versions. Pnpm defaults its minimum release age to one day, and Dependabot applies a default three day cooldown to version updates, but not to security updates.
6. Limit install-time code. The npm ignore-scripts option stops scripts in package.json files from running, and pnpm v10 disables automatic postinstall scripts in dependencies.
7. Keep an inventory (SBOM) of direct and transitive packages.
8. Watch for changes after the scan: new advisories, new publishers, removed versions.
9. Separate build and deploy credentials, so an install step cannot reach production keys.
10. Rehearse the response. Know how to find which builds used a bad version and how to rebuild.

Trade-offs to expect

Locking and delaying slow you down a little. Install script limits can break packages that need a build step, so list the ones you trust explicitly. Pnpm recommends allowing builds only for named dependencies.

How to roll it out

Do not try all ten in a week. Pick three: lockfiles with frozen installs, dependency review on pull requests and the delay. They cost little and cover several entry points. Add the rest over a quarter.

Try it yourself

Click through it at your own pace, or open it full screen. Watch how a pull request is held until a policy check passes.

Where Safeguard fits

Safeguard covers SBOM and dependency scanning, policies and gates for pull requests, and continuous monitoring, which map to steps four, seven and eight. A free scan will show your current inventory.

Quick check

Sources

• pip: Getting started and index options
• pip: Secure installs
• pnpm: Mitigating supply chain attacks
• GitHub Docs: Dependabot options reference
• GitHub Docs: Dependency review
• npm Docs: npm install, ignore-scripts

Last reviewed: 19 October 2026.