security: harden npm install against supply chain attacks

[yeelali14]

Summary

• Add npm cache clean --force before install to prevent stale/malicious cached tarballs
• Add --ignore-scripts to block malicious postinstall hooks (e.g. axios supply chain CVE)
• Remove --silent to make installed package versions visible in logs

Context

In response to the axios npm supply chain compromise (March 31, 2026), where attackers published backdoored versions 1.14.1 and 0.30.4 via a hijacked maintainer account. The malicious versions used a postinstall hook to deploy a cross-platform RAT. --ignore-scripts ensures postinstall hooks are never executed regardless of what version is installed.

Test plan

• Trigger a gitStream workflow run and verify npm cache clean --force appears in logs
• Verify added N packages output is visible (no --silent)
• Verify no postinstall scripts are executed

🤖 Generated with Claude Code

✨ PR Description

Purpose: Harden npm package installation process to prevent supply chain attacks by disabling script execution and clearing cached packages.

Main changes:

• Added npm cache clean step before dependency installation to prevent poisoned cache exploitation
• Replaced --silent flag with --ignore-scripts to block malicious postinstall scripts from executing
• Reordered workflow to clear cache immediately before installing pinned dependency versions

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	OSS Licenses	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[linearb]

✨ PR Review

Agentic review
LGTM

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Review using Guidelines Learn how}