@paystack/checkout-js 1.52.0-beta.9 → 1.53.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +36 -0
- package/dist/checkout.js +29 -22565
- package/es/checkout.js +28 -22551
- package/lib/checkout.js +28 -22559
- package/package.json +10 -1
package/README.md
CHANGED
|
@@ -10,3 +10,39 @@ or just grab the js file and add it to your html directly
|
|
|
10
10
|
```html
|
|
11
11
|
<script src="https://js.paystack.co/v1/checkout.js"></script>
|
|
12
12
|
```
|
|
13
|
+
|
|
14
|
+
# Development Setup
|
|
15
|
+
|
|
16
|
+
This project uses **pnpm** with security hardening for deterministic, reproducible installs.
|
|
17
|
+
|
|
18
|
+
## First Time Setup
|
|
19
|
+
1. Enable Corepack: `corepack enable` (may need `sudo` on Linux)
|
|
20
|
+
2. Install dependencies: `pnpm install`
|
|
21
|
+
3. Run tests: `pnpm test`
|
|
22
|
+
4. Build: `pnpm run build:production`
|
|
23
|
+
|
|
24
|
+
Corepack reads the `packageManager` field in `package.json` to provide the exact pnpm version.
|
|
25
|
+
|
|
26
|
+
## For CI / Production Installs
|
|
27
|
+
Always use:
|
|
28
|
+
```bash
|
|
29
|
+
pnpm install --frozen-lockfile
|
|
30
|
+
pnpm rebuild core-js fsevents husky nodent-runtime
|
|
31
|
+
```
|
|
32
|
+
|
|
33
|
+
## Security Settings
|
|
34
|
+
- **ignore-scripts=true**: Blocks arbitrary postinstall/preinstall scripts during install (primary supply chain attack vector)
|
|
35
|
+
- **strict-ssl=true**: Prevents man-in-the-middle attacks during package downloads
|
|
36
|
+
- **registry pinning**: Ensures all packages come from official npm registry
|
|
37
|
+
- **engine-strict=true**: Enforces Node version requirements from package.json
|
|
38
|
+
- **minimum-release-age=2880**: Delays installing newly published packages by 48 hours (time for community to detect compromised releases)
|
|
39
|
+
|
|
40
|
+
## Native Dependencies
|
|
41
|
+
This project has packages that need to compile native code: `core-js, fsevents, husky, nodent-runtime`
|
|
42
|
+
|
|
43
|
+
These are explicitly rebuilt after install to ensure compatibility while maintaining security controls.
|
|
44
|
+
|
|
45
|
+
## References
|
|
46
|
+
- [OWASP Top 10 CI/CD Security Risks](https://owasp.org/www-project-top-10-ci-cd-security-risks/)
|
|
47
|
+
- [pnpm Security Documentation](https://pnpm.io/npmrc#minimum-release-age)
|
|
48
|
+
- Project security hardening: See `.npmrc` for complete settings
|