Replace npx with pinned npm-tools and add security hardening #21166

corneliusludmann · 2025-12-03T14:22:41Z

What

Replace npx calls with globally available tools installed from dev/npm-tools
Pin tool versions via package-lock.json for reproducible builds
Add security hardening to both dev container images

Why

npx downloads and executes packages without version pinning, leading to inconsistent builds
Global npm install -g doesn't use a lockfile, so versions can drift
Security hardening reduces attack surface from malicious packages

Changes

New: `dev/npm-tools/`

package.json with pinned dependencies: typescript, prettier, yarn, pnpm, node-gyp, @anthropic-ai/claude-code
package-lock.json for reproducible installs

Dockerfiles (`.devcontainer/Dockerfile`, `dev/image/Dockerfile`)

Remove npm install -g for tools now in npm-tools
Install npm-tools via npm ci and symlink binaries to /usr/local/bin
Disable npm/yarn lifecycle scripts by default (security)
Disable npx (security)

Component package.json files

npx tsc → tsc
npx prettier → prettier

Notes

Lifecycle scripts are disabled by default. Use npm rebuild <package> for packages requiring postinstall scripts.
npx is disabled. Use explicit package installation via npm-tools instead.

Fixes PDE-163
Fixes PDE-176

kylos101

On L338 we do npm install, should we have a lockfile change added in this PR too, so that when npm install is done, it is constrained? For example, to use specific versions of typescript yarn pnpm node-gyp @anthropic-ai/claude-code.

.devcontainer/Dockerfile

kylos101

Also, it would be great to duplicate these changes in dev/image/Dockerfile, and redo the image in .gitpod.yml, so that if/when workspaces are started in Classic for this repo, they have similar protection. Although for now, I'll exclusively use Ona to avoid such potential.

socket-security · 2025-12-03T15:57:48Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/xunit-viewer@10.6.1
	npm/bun@1.3.3
	npm/yarn@1.22.22
	npm/@anthropic-ai/claude-code@2.0.57
	npm/node-gyp@10.3.1
	npm/pnpm@9.15.9
	npm/typescript@5.9.3
	npm/prettier@3.7.4

View full report

kylos101

👋 @corneliusludmann , I built and inspected the .devcontainer/Dockerfile.

npx also needs to be deleted from the nvm folder
I'm unsure what we're trying to accomplish by ignoring scripts at the user level (which I cannot inspect), instead of global
there are additional global package considerations (one for a test and the new dev/npm-tools, and one for Github workflows which I think should avoid dev/npm-tools)

kylos101 · 2025-12-03T21:45:13Z

dev/npm-tools/package.json

@corneliusludmann should we put anything we install globally here?

If so, I think we'll want to add additional tools:

xunit-viewer

There are also many places in Github Workflows where we globally install bun.

But, I am thinking we don't want to use dev/npm-tools to install packages for each github workflow. And so, it should probably have it's own.

kylos101 · 2025-12-03T22:00:44Z

.devcontainer/Dockerfile

Built the image like:

vscode ➜ /workspaces/workspaces/gitpod (clu/npm-security-hardening) $ docker build -f .devcontainer/Dockerfile .

kylos101 · 2025-12-03T22:10:38Z

.devcontainer/Dockerfile

+# Disable npx (security hardening - prevents arbitrary package execution)
+RUN rm -f /usr/bin/npx /usr/local/bin/npx && \
+    echo '#!/bin/sh' > /usr/local/bin/npx && \
+    echo 'echo "npx is disabled for security reasons. Use explicit package installation instead." >&2' >> /usr/local/bin/npx && \


Works:

root / $ /usr/local/bin/npx npx is disabled for security reasons. Use explicit package installation instead.

kylos101 · 2025-12-03T22:11:35Z

.devcontainer/Dockerfile

+    echo 'ignore-scripts true' >> ~/.yarnrc
+
+# Disable npx (security hardening - prevents arbitrary package execution)
+RUN rm -f /usr/bin/npx /usr/local/bin/npx && \


npx is also located as part of the nvm installation, we should remove it from here too:

Evidence:

vscode ➜ /workspaces/workspaces/gitpod (clu/npm-security-hardening) $ docker run -it abe5f93ace01 root / $ nvm which node /root/.nvm/versions/node/v22.17.0/bin/node root / $ which npx /root/.nvm/versions/node/v22.17.0/bin/npx

kylos101 · 2025-12-03T22:25:38Z

.devcontainer/Dockerfile

+
+# Disable npm/yarn lifecycle scripts by default (security hardening)
+# To allow specific packages, use: npm rebuild <package> or yarn rebuild <package>
+RUN npm config set ignore-scripts true --location=user && \


I see this is set for global:

npm config get ignore-scripts --location=global true

But get an error at the user (default) level:

pm config get ignore-scripts --location=user npm error code ENOWORKSPACES npm error This command does not support workspaces. npm error A complete log of this run can be found in: /root/.npm/_logs/2025-12-03T22_23_34_233Z-debug-0.log

What are we trying to accomplish here? Global makes sense to me, if we're talking a Dockerfile.

The latter part of the command seems okay:

cat $HOME/.yarnrc ignore-scripts true

But, I'm unsure of the former.

kylos101 · 2025-12-03T22:27:03Z

dev/image/Dockerfile

This file will need improvements similar to what I mentioned in .devcontainer/Dockerfile

geropl · 2025-12-04T07:47:16Z

Also, it would be great to duplicate these changes in dev/image/Dockerfile, and redo the image in .gitpod.yml, so that if/when workspaces are started in Classic for this repo, they have similar protection

Yes - that's also the image we use in the workflows. 👍

@corneliusludmann Next steps to have this built and merged are these here I think: https://gitpod.slack.com/archives/C071G5TTS49/p1764834081132659

Once the build is green (and the new dev-image is built as an side effect), we can raise a follow-up to use it everywhere, as Kyle suggested here. 👍
Alternatively you can try to build and push it from the environment, not sure how well that works 🤷

Co-authored-by: Ona <no-reply@ona.com>

geropl · 2025-12-05T08:26:43Z

FYI I'm currently iterating on build issues here: #21169

The symlink at /root/.nvm/.../bin/npx points to npx-cli.js. Remove both to ensure npx is fully disabled. Co-authored-by: Ona <no-reply@ona.com>

Replace self-hosted GCE runner pattern with GitHub-hosted ubuntu-latest runners across all workflows. This removes the three-phase pattern (create-runner, use-runner, delete-runner) and simplifies workflow execution. Changes: - Remove create-runner and delete-runner jobs from all workflows - Replace runs-on: ${{ needs.create-runner.outputs.label }} with runs-on: ubuntu-latest - Remove create-runner from job dependencies - Preserve all other job dependencies and concurrency controls Affected workflows: - build.yml (8 jobs) - workspace-integration-tests.yml (4 jobs) - ide-integration-tests.yml (4 jobs) - preview-env-check-regressions.yml (4 jobs) - preview-env-gc.yml (2 jobs) - jetbrains-auto-update-template.yml (1 job) - jetbrains-integration-test.yml (1 job) - code-nightly.yml (1 job) - preview-env-delete.yml (1 job) Co-authored-by: Ona <no-reply@ona.com>

Add 'options: --user root' to all container configurations to resolve EACCES permission errors when GitHub Actions tries to write to internal directories. GitHub-hosted runners require containers to run as root to allow the Actions runtime to write to /__w/_temp/_runner_file_commands/ and other internal paths. Affected workflows: - build.yml (3 container jobs) - workspace-integration-tests.yml (2 container jobs) - ide-integration-tests.yml (2 container jobs) - preview-env-check-regressions.yml (1 container job) - preview-env-gc.yml (1 container job) - jetbrains-auto-update-template.yml (1 container job) - jetbrains-integration-test.yml (1 container job) - code-nightly.yml (1 container job) Co-authored-by: Ona <no-reply@ona.com>

Create leeway generic build for dev/npm-tools and use it as a dependency in dev/image:docker build. This resolves the build error where npm-tools files were not accessible during Docker build. Changes: - Add dev/npm-tools/BUILD.yaml with generic package containing package.json and package-lock.json - Add dev/npm-tools:pkg as dependency in dev/image/BUILD.yaml - Update Dockerfile to use COPY from leeway dependency path (dev-npm-tools--pkg/) This follows the established pattern used in other builds like install/installer where dependencies are copied from leeway-generated paths. Co-authored-by: Ona <no-reply@ona.com>

Add chown command to fix EACCES permission error when installing npm-tools. The COPY command creates files owned by root, but npm ci runs as gitpod user and needs write access to create node_modules. Changes: - Add 'sudo chown -R gitpod:gitpod /opt/npm-tools' before npm ci - This ensures the gitpod user can write to /opt/npm-tools/node_modules/ Error fixed: npm error code EACCES npm error syscall mkdir npm error path /opt/npm-tools/node_modules npm error errno -13 Co-authored-by: Ona <no-reply@ona.com>

Co-authored-by: Ona <no-reply@ona.com>

kylos101 · 2025-12-04T16:09:44Z

.github/workflows/code-build.yaml

          curl -fsSL https://github.com/csweichel/oci-tool/releases/download/v0.2.1/oci-tool_0.2.1_linux_amd64.tar.gz | tar xz -C /usr/local/bin
          chmod +x /usr/local/bin/oci-tool
-          cd ./components/ide/gha-update-image/
+          cd ./dev/npm-tools && npm ci


Nit, non-blocking:
The only con here, is we're installing more tools at runtime than we need, so, it means the workflows will take that much longer.

But, I think we can live with this, for the short time Classic remains.

[dev] disable npm lifecycle scripts and npx

e168a9c

corneliusludmann requested a review from kylos101 December 3, 2025 14:22

Add npm-tools

2897ffa

kylos101 reviewed Dec 3, 2025

View reviewed changes

.devcontainer/Dockerfile Show resolved Hide resolved

kylos101 reviewed Dec 3, 2025

View reviewed changes

update npm-tools

22f22b7

corneliusludmann requested a review from a team as a code owner December 3, 2025 15:54

github-actions bot added the team: team-enterprise label Dec 3, 2025

dev/image/Dockerfile

a1f2efa

corneliusludmann changed the title ~~[dev] disable npm lifecycle scripts and npx~~ Replace npx with pinned npm-tools and add security hardening Dec 3, 2025

kylos101 reviewed Dec 3, 2025

View reviewed changes

Cornelius Ludmann and others added 2 commits December 4, 2025 09:58

update

8fe30fd

Co-authored-by: Ona <no-reply@ona.com>

Bump leeay version to 0.10.6

abac094

Co-authored-by: Ona <no-reply@ona.com>

corneliusludmann and others added 7 commits December 5, 2025 09:56

Fix npx removal to also delete the target script

f15e31b

The symlink at /root/.nvm/.../bin/npx points to npx-cli.js. Remove both to ensure npx is fully disabled. Co-authored-by: Ona <no-reply@ona.com>

[dev] use ubuntu-latest-16-cores for builds

7f2dcb5

[dev] Split builds into branch and main

fae8573

Co-authored-by: Ona <no-reply@ona.com>

geropl temporarily deployed to branch-build December 5, 2025 15:20 — with GitHub Actions Inactive

geropl had a problem deploying to branch-build December 5, 2025 15:20 — with GitHub Actions Error

kylos101 approved these changes Dec 5, 2025

View reviewed changes

Ona-Security-Admin merged commit e9f25f4 into main Dec 5, 2025
7 of 8 checks passed

Ona-Security-Admin deleted the clu/npm-security-hardening branch December 5, 2025 15:25

geropl deployed to branch-build December 5, 2025 17:04 — with GitHub Actions Active

geropl had a problem deploying to branch-build December 5, 2025 17:04 — with GitHub Actions Failure

Replace npx with pinned npm-tools and add security hardening #21166

Replace npx with pinned npm-tools and add security hardening #21166

Uh oh!

Conversation

corneliusludmann commented Dec 3, 2025 • edited by geropl Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Changes

New: dev/npm-tools/

Dockerfiles (.devcontainer/Dockerfile, dev/image/Dockerfile)

Component package.json files

Notes

Uh oh!

kylos101 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kylos101 left a comment

Choose a reason for hiding this comment

Uh oh!

socket-security bot commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kylos101 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

geropl commented Dec 4, 2025

Uh oh!

geropl commented Dec 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

corneliusludmann commented Dec 3, 2025 •

edited by geropl

Loading

New: `dev/npm-tools/`

Dockerfiles (`.devcontainer/Dockerfile`, `dev/image/Dockerfile`)

socket-security bot commented Dec 3, 2025 •

edited

Loading