Getting Started

Prerequisites

LavaMoat is distributed as a Node.js command-line tool. You’ll need an LTS version of Node.js:

• Node.js LTS (recommended) or
• Node.js v22 (minimum)

Tip

Don’t have Node.js installed? Download and install Node.js from the official site.

How to secure your app against supply-chain attacks

1. Harden your project’s configuration with @lavamoat/harden 1.a. Or control dependency lifecycle scripts (eg. “postinstall”) via @lavamoat/allow-scripts
2. Run your server or build process in lavamoat-node
3. Build your ui with our Webpack5 plugin or use LavaMoat for Browserify

Tip

On modern versions of npm, yarn, or pnpm, @lavamoat/harden is the preferred entry point and replaces @lavamoat/allow-scripts. @lavamoat/harden covers lifecycle scripts alongside other supply-chain hardening settings. Just doing the first step is a great improvement to your supply chain security.