Getting Started

Prerequisites

LavaMoat is distributed as a Node.js command-line tool. You’ll need an LTS version of Node.js:

• Node.js v20.0.0 (recommended) or
• Node.js v16.20.0 (minimum)

Tip

Don’t have Node.js installed? Download and install Node.js from the official site.

How to secure your app against supply-chain attacks

1. Control dependency lifecycle scripts (eg. “postinstall”) via @lavamoat/allow-scripts
2. Run your server or build process in lavamoat-node
3. Build your ui with our Webpack5 plugin (beta) or use LavaMoat for Browserify

Tip

Starting with just step 1 - the allow-scripts, is a great improvement to your supply chain security. Majority of supply-chain attacks are delivered via lifecycle scripts.