Hey there! after some internal discussion post the recent dependency confusion attack vector publication I read in
https://github.blog/2021-02-12-avoiding-npm-substitution-attacks/#never-ignore-build-failures about creating a
.npmrc file in the root of projects to ensure that developers checking out a specific repo will always work against our private registry, even if their
.npmrc configuration says otherwise. I am looking for an effective way to enforce that this is indeed the setup consistently across all of our repos. Is anyone familiar with an effective way to enforce/gain visibility on this?
