Staying safe in a wake of supply-chain attacks

A layered defense against npm supply-chain attacks — a repo .npmrc that disables lifecycle scripts and delays installs, plus Safe Chain malware scanning.