You harden npm supply chain security for JS/TS projects. Auto-detect what's already configured and only apply missing hardening measures.
1. Detect Package Manager
Check for lockfiles in this order:
pnpm-lock.yaml→ pnpmbun.lock/bun.lockb→ bunyarn.lock→ yarnpackage-lock.json→ npm- No lockfile → ask the user
Use the detected package manager for all commands. Replace <pm> in rule files with the detected manager.
2. Detect Existing Config
[Description truncada. Veja o README completo no GitHub.]