[APS-19734] fix: harden .npmrc with supply-chain security directives

[Rohannagariya1]

Security Fix: APS-19734

Issue

The repo's .npmrc failed the weekly supply-chain .npmrc audit (SC-12282) — it contained only package-lock=true / lockfile-version=1 and was missing the required hardening directives.

Root Cause

Missing npm hardening directives that protect against malicious lifecycle scripts, TLS downgrade, version drift, and incompatible engines.

Fix Applied

Added the 6 required directives, preserving the existing two lines:

ignore-scripts=true
strict-ssl=true
save-exact=true
engine-strict=true
legacy-peer-deps=false
audit-level=high

This is a public repo, so access=restricted is intentionally omitted.

ignore-scripts compatibility (the cypress-CLI concern)

This is the Cypress CLI tool, so we explicitly verified ignore-scripts=true does not break install or tests:

• Root package.json has no preinstall/install/postinstall scripts.
• browserstack-local lazy-downloads the BrowserStackLocal binary at runtime (first use), not via an npm install script — so blocking install scripts does not prevent the binary fetch.
• No engines field, so engine-strict=true is a no-op here.

Testing (before vs after, clean node_modules)

Step	Before (no ignore-scripts)	After (with all 6 directives)
npm install	exit 0	exit 0
npm test (mocha)	678 passing, 13 failing, 2 pending	678 passing, 13 failing, 2 pending

The 13 failures are pre-existing (error-report / deleteZip / table-config / video-config suites) and the failing-test set is byte-identical before and after — confirmed via diff. No regression introduced by the directives.

Jira Ticket

https://browserstack.atlassian.net/browse/APS-19734

Checklist

• Security issue addressed
• npm install + npm test validated identical before/after
• ignore-scripts conflict checked — none (no install scripts; binary fetched at runtime)
• BrowserStack session run (N/A — config-only .npmrc change)

[Rohannagariya1]

Closing as not needed — synced with Shabbir (Security EM). The supply-chain .npmrc hardening flagged by the Enigma audit is not required for these repos; dropping per that decision.

[Rohannagariya1]

Reopening — closed in error. This repo is internal per Rohan; keeping the hardened .npmrc PR open. Only the open-source sample repos are being dropped (synced with Shabbir, Security EM).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 6fbff812-e328-48be-8d7e-892104e215e5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}