Hardening Your npm CI in 5 Concrete Layers

Intro Your CI pipeline installs dependencies far more often than any developer’s laptop. That frequency makes it the biggest npm attack surface. I recently saw the Bitwarden breach where a hijacked GitHub Action pulled a malicious CLI for 90 minutes and harvested every credential on the runner. Below is the exact 5‑layer playbook we dog‑fooded at ShipWithAI to stop that. The Problem Most CI configs still look like this: - uses : actions/checkout@v4 # mutable tag - uses : actions/setup-node@v4 #