Security oriented config package

[fraxken]

My plan is to create a new configuration package that provides security for our packages and reduces the need to manage multiple dependencies per package.

Some initial ideas:

• https://github.com/lirantal/lockfile-lint to prevent malicious modification of package.json by third-party actors.

npx lockfile-lint --path yarn.lock --allowed-hosts npm yarn --validate-https

• Minimal integration of JS-X-Ray (or @nodesecure/tarball) which implement primitive to scan a given directory.
  • Anti-trojan-source
  • Circular dependencies using the built-in digraph-js (like skott).