npmrc机密治理与令牌最小权限（always-auth-作用域）最佳实践

核心要点启用 `always-auth` 与严格来源白名单；屏蔽明文令牌与弱权限。作用域到注册表映射一致性校验；仅允许只读拉取权限。实现示例type Npmrc = { registry?: string; alwaysAuth?: boolean; token?: string; scopeRegistry?: { [scope: string]: string } } const allowRegistries = new Set<string>(['https://registry.npmjs.org','https://registry.example.com']) function validRegistry(u?: string): boolean { if (!u) return false try { const url = new URL(u) return url.protocol === 'https:' && allowRegistries.has(url.origin) } catch { return false } } function tokenSafe(t?: string): boolean { if (!t) return false return !/[\s"']/.test(t) } function policy(n: Npmrc): { ok: boolean; errors: string[] } { const errors: string[] = [] if (!validRegistry(n.registry)) errors.push('registry') if (n.alwaysAuth !== true) errors.push('always-auth') if (!tokenSafe(n.token)) errors.push('token') if (n.scopeRegistry) { for (const [scope, reg] of Object.entries(n.scopeRegistry)) { if (!validRegistry(reg)) errors.push(`scope:${scope}`) } } return { ok: errors.length === 0, errors } } 审计与运行治理配置变更需审批与审计；生产环境仅加载受控机器配置。禁止明文令牌输出与日志；令牌权限仅限 `read:packages`。