Owner

LavaMoat

3 indexed repositories · View on GitHub

LavaMoat
tools for sandboxing your dependency graph

JavaScript · 1222 stars
kipuka
Easy, composable and transparent way to run things in a docker container.

JavaScript · 36 stars
lavamoat.github.io
Documentation site for the LavaMoat project

MDX · 3 stars

Beginner friendly Everything

Open All

harden: npm script-shell runner crashes without scriptsConfig and breaks installs of deps with install scripts Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

LavaMoat/LavaMoat#2108 · Opened Sep 13, 2026
harden wizard overrides existing settings Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

LavaMoat/LavaMoat#2085 · Opened Aug 13, 2026
ci: enable strict collection mode when zizmor-action supports it Open

chore

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

LavaMoat/LavaMoat#2071 · Opened Jul 17, 2026
Waht about npm approve-scripts command? Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

LavaMoat/LavaMoat#2041 · 1 comment · Opened Jun 26, 2026
allow-scripts should allow transitive optional dependencies to fail Open

Difficulty 4/5 3-5 days Newbie friendliness 50/100

LavaMoat/LavaMoat#2029 · Opened Jun 22, 2026
remove 'install' from .npmrc Open

chore

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

LavaMoat/LavaMoat#1990 · 3 comments · Opened May 26, 2026
core: new warning emitted in endowmentsToolkit under Node.js v26 Open

bug

LavaMoat/LavaMoat#1987 · 2 comments · 1 assignee · Opened May 26, 2026
Dependency Dashboard Open

Difficulty 4/5 3-5 days Newbie friendliness 20/100

LavaMoat/lavamoat.github.io#31 · Opened May 8, 2026
Prints `undefined` if docker not installed Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

LavaMoat/kipuka#3 · Opened Apr 23, 2026
pnpm scripts are incompatible with `--bin` Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

LavaMoat/LavaMoat#1948 · 4 comments · Opened Apr 13, 2026
allow-scripts: extend shared config Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

LavaMoat/LavaMoat#1938 · 2 comments · Opened Apr 8, 2026
How to whitelist root `postinstall` while blocking dependency scripts? Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

LavaMoat/LavaMoat#1937 · 2 comments · 1 reaction · Opened Apr 3, 2026
confusing new user experience with node v25 -- old version of allow-scripts installs Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

LavaMoat/LavaMoat#1931 · Opened Mar 31, 2026
lavamoat/node beta issues from testing Open

pkg:@lavamoat/node

LavaMoat/LavaMoat#1896 · 2 assignees · Opened Mar 10, 2026
Is there anyway to allow the top level lifecycle scripts to run last? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

LavaMoat/LavaMoat#1875 · 4 comments · Opened Dec 26, 2025
fix types of SesCompat errors Open

chore pkg:lavamoat-core

Difficulty 4/5 3-5 days Newbie friendliness 35/100

LavaMoat/LavaMoat#1874 · Opened Dec 15, 2025
scope of @lavamoat/policy Open

enhancement

LavaMoat/LavaMoat#1854 · 2 assignees · Opened Nov 18, 2025
Tracking issue for webpack plugin DX fall2025 Open

LavaMoat/LavaMoat#1831 · 1 assignee · Opened Sep 25, 2025
Allow pinning allowed scripts, or some other mechanism to protect against unauthorised script updates. Open

enhancement pkg:@lavamoat/allow-scripts

LavaMoat/LavaMoat#1814 · 4 comments · 2 reactions · 1 assignee · Opened Sep 17, 2025
allow-scripts: make tests ignore cli flags, or something Open

chore pkg:@lavamoat/allow-scripts pkg:@lavamoat/laverna

Difficulty 3/5 1-2 days Newbie friendliness 45/100

LavaMoat/LavaMoat#1813 · Opened Sep 16, 2025
laverna: add a --skip flag Open

enhancement pkg:@lavamoat/laverna

LavaMoat/LavaMoat#1812 · 1 assignee · Opened Sep 16, 2025
`--experimental-bins` simply doesn't work at all? Open

developer experience pkg:@lavamoat/allow-scripts

LavaMoat/LavaMoat#1801 · 5 comments · 1 assignee · Opened Sep 10, 2025
git-safe-dependencies tests are failing when github API is having a bad day Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

LavaMoat/LavaMoat#1763 · Opened Aug 12, 2025
git-safe-dependencies: workflows dir should be .github/workflows/ Open

bug pkg:@lavamoat/git-safe-dependencies

Difficulty 2/5 1-3 hours Newbie friendliness 62/100

LavaMoat/LavaMoat#1758 · Opened Aug 11, 2025
Guard against obsolete policy overrides Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

LavaMoat/LavaMoat#1750 · 2 comments · 1 reaction · Opened Aug 4, 2025
@lavamoat/node: tree-shaking policy Open

developer experience enhancement pkg:@lavamoat/node r&d

Difficulty 5/5 Over a week Newbie friendliness 35/100

LavaMoat/LavaMoat#1745 · Opened Jul 30, 2025
all public scoped packages must have a publishConfig Open

chore pkg:@lavamoat/laverna

Difficulty 3/5 1-2 days Newbie friendliness 45/100

LavaMoat/LavaMoat#1725 · 1 comment · 1 reaction · Opened Jun 24, 2025
Strictly assert module has the resource field (in webpack plugin moduleData) Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

LavaMoat/LavaMoat#1717 · Opened Jun 24, 2025
git-safe-dependencies: retry E2E tests Open

chore pkg:@lavamoat/git-safe-dependencies

LavaMoat/LavaMoat#1714 · 1 assignee · Opened Jun 16, 2025
document supported browser versions & policy Open

documentation

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

LavaMoat/LavaMoat#1703 · Opened Jun 10, 2025
checklist for dropping node.js v18 Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

LavaMoat/LavaMoat#1681 · 3 comments · Opened Jun 2, 2025
policy generation hints Open

enhancement pkg:@lavamoat/node

LavaMoat/LavaMoat#1679 · 1 reaction · 1 assignee · Opened May 29, 2025
policy gen: consider policy overrides before printing warnings Open

enhancement pkg:@lavamoat/node

LavaMoat/LavaMoat#1664 · 1 assignee · Opened May 16, 2025
policy overrides, dynamic requires, canonical names & ux Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

LavaMoat/LavaMoat#1663 · 1 comment · Opened May 16, 2025
a better story for handling statically-required optional dependencies in policy gen Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 30/100

LavaMoat/LavaMoat#1662 · 3 comments · Opened May 16, 2025
We need to rethink WindowProxy object endowment Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

LavaMoat/LavaMoat#1652 · 1 comment · Opened May 11, 2025
tofu: report parse errors Open

developer experience pkg:lavamoat-tofu

Difficulty 4/5 3-5 days Newbie friendliness 35/100

LavaMoat/LavaMoat#1628 · Opened Apr 29, 2025
"@lavamoat/webpack": "0.9.0-beta.0" crashes Open

bug

LavaMoat/LavaMoat#1606 · 2 comments · 1 assignee · Opened Apr 23, 2025
audit support for unicode fieldnames Open

chore

Difficulty 5/5 Over a week Newbie friendliness 25/100

LavaMoat/LavaMoat#1595 · Opened Apr 14, 2025
node: possible logging Open

chore enhancement

Difficulty 5/5 Over a week Newbie friendliness 20/100

LavaMoat/LavaMoat#1594 · Opened Apr 14, 2025
tofu: report warning during parse if encountering a dynamic import() Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 38/100

LavaMoat/LavaMoat#1591 · Opened Apr 5, 2025
@lavamoat/node: support "redefine" global policy in attenuator Open

enhancement pkg:@lavamoat/node

LavaMoat/LavaMoat#1584 · 1 assignee · Opened Mar 26, 2025
lavamoat-core: implement wrapper for Object.defineProperty / Object.defineProperties Open

enhancement pkg:lavamoat-core

LavaMoat/LavaMoat#1582 · 1 assignee · Opened Mar 26, 2025
support defining properties on globalThis Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

LavaMoat/LavaMoat#1581 · 4 comments · 1 reaction · Opened Mar 26, 2025
core: handle dots in property names Open

bug pkg:lavamoat-core

Difficulty 5/5 Over a week Newbie friendliness 25/100

LavaMoat/LavaMoat#1577 · Opened Mar 25, 2025
language-agnostic policy generation Open

r&d

Difficulty 5/5 Over a week Newbie friendliness 20/100

LavaMoat/LavaMoat#1568 · Opened Mar 21, 2025
a standardized CLI framework Open

developer experience documentation enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

LavaMoat/LavaMoat#1567 · 1 reaction · Opened Mar 21, 2025
SES incompatibility guide Open

documentation

Difficulty 3/5 1-2 days Newbie friendliness 45/100

LavaMoat/lavamoat.github.io#19 · 1 reaction · Opened Mar 21, 2025
tofu: detect dynamic imports and warn Open

enhancement pkg:lavamoat-tofu

LavaMoat/LavaMoat#1566 · 1 assignee · Opened Mar 21, 2025
whitelisted package executing a prototype pollution attack Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

LavaMoat/LavaMoat#1565 · Opened Mar 18, 2025

Showing the newest 100

This page lists what was indexed most recently. Advanced filter has the whole inventory, narrowed by language, difficulty and how long a task takes.

Open advanced filter

LavaMoat

Showing the newest 100

Get new issues in your inbox