Merge pull request #15 from browserstack/sec/LTS-3295-npmrc-hardening

LTS-3295: add supply-chain hardened .npmrc

Author: pattu777

.npmrc

@@ -0,0 +1,22 @@
+# Supply-chain hardening directives (SC-12282 / LTS-3295)
+# See: https://browserstack.atlassian.net/wiki/spaces/ENG/pages/6091571922/Supply+Chain+Security+Enhancements+Tech+Spec
+#
+# access=restricted is intentionally OMITTED — this is a public, customer-facing
+# sample repository, not a published private package.
+#
+# ignore-scripts=true is now safe: these tests run remotely on BrowserStack, and
+# Edge/Gecko are not supported on our platform, so the local driver-binary
+# postinstalls (edgedriver/geckodriver) are not needed. browserstack-node-sdk is
+# pinned to the latest release (1.61.0) so no update-postinstall is needed either.
+#
+# engine-strict=true enforces the package.json `engines.node` floor (>=18), which
+# matches our runner pod and what @wdio/cli 9 already requires. Customers on EOL
+# Node (<18) get a clear upgrade message instead of obscure failures.
+
+strict-ssl=true
+save-exact=true
+audit-level=high
+legacy-peer-deps=false
+ignore-scripts=true
+engine-strict=true
+min-release-age=7