[APS-19734] fix: harden .npmrc with supply-chain security directives

[Rohannagariya1]

Security Fix: APS-19734

Issue

The repo's .npmrc failed the weekly supply-chain .npmrc audit (SC-12282) — it contained only package-lock=true / lockfile-version=1 and was missing the required hardening directives.

Root Cause

Missing npm hardening directives that protect against malicious lifecycle scripts, TLS downgrade, version drift, and incompatible engines.

Fix Applied

Added the 6 required directives, preserving the existing two lines:

ignore-scripts=true
strict-ssl=true
save-exact=true
engine-strict=true
legacy-peer-deps=false
audit-level=high

This is a public repo, so access=restricted is intentionally omitted.

ignore-scripts compatibility (the cypress-CLI concern)

This is the Cypress CLI tool, so we explicitly verified ignore-scripts=true does not break install or tests:

• Root package.json has no preinstall/install/postinstall scripts.
• browserstack-local lazy-downloads the BrowserStackLocal binary at runtime (first use), not via an npm install script — so blocking install scripts does not prevent the binary fetch.
• No engines field, so engine-strict=true is a no-op here.

Testing (before vs after, clean node_modules)

Step	Before (no ignore-scripts)	After (with all 6 directives)
npm install	exit 0	exit 0
npm test (mocha)	678 passing, 13 failing, 2 pending	678 passing, 13 failing, 2 pending

The 13 failures are pre-existing (error-report / deleteZip / table-config / video-config suites) and the failing-test set is byte-identical before and after — confirmed via diff. No regression introduced by the directives.

Jira Ticket

https://browserstack.atlassian.net/browse/APS-19734

Checklist

• Security issue addressed
• npm install + npm test validated identical before/after
• ignore-scripts conflict checked — none (no install scripts; binary fetched at runtime)
• BrowserStack session run (N/A — config-only .npmrc change)