Dev tools · alternatives · 2026
24 alternatives to Auto-Unpublish NPM Packages Published Outside CI
A lot of vendors and open-source projects shared guidance on protecting users from downloading malicious NPM packages after the Shai-Hulud campaign — but almost nothing focused on protecting maintainers from accidentally (or maliciously) publishing them. So we built a small tool that continuously monitors your NPM packages and automatically unpublishes any version not produced by your CI workflow.
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Prices are shown for the 1 we have checked on their own sites, 1 of them free or with a free tier.
- 1
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com · its alternatives →
- 2
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com · its alternatives →
- 3
Refuse▲84Block vulnerable package installs for you and your AI
Jun 2026 · refuse.dev · its alternatives →
- 4
The backstory about this GitHub Action: I discussed with an open-source maintainer why they publish npm packages from their local machine and do not use CI/CD pipelines. They said publishing should require human intervention and want to continue using multi-factor authentication to publish to the npm registry. This led to building the wait-for-secrets GitHub Action. It prints a URL in the build log and waits for secrets to be entered using a browser. Once entered, the workflow continues, and secrets can be used in future steps. The latest release of "eslint-plugin-react" to the npm…
2022 · github.com · its alternatives →
- 5AI
2016 · npmjs.com · its alternatives →
- 6
Monitor NuGet and NPM packages in your repositories
2021 · its alternatives →
- 7
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
2025 · github.com · its alternatives →
- 8
Bumplyfree tier, from $27.24/mo▲113Update your dependencies and undo anything
Aug 2026 · bumply.app · its alternatives →
- 9
I'm a software engineer who keeps getting pulled into DevOps no matter how hard I try to escape it. I recently moved into a Lead DevOps Engineer role writing tooling to automate a lot of the pain away. On my own time outside of work, I built Artifact Keeper — a self-hosted artifact registry that supports 45+ package formats. Security scanning, SSO, replication, WASM plugins — it's all in the MIT-licensed release. No enterprise tier. No feature gates. No surprise invoices. Your package managers — pip, npm, docker, cargo, helm, go, all of them — talk directly to it using their native…
Feb 2026 · github.com · its alternatives →
- 10
DepsGuard▲10Configure once, prevent the next compromised package install
May 2026 · depsguard.com · its alternatives →
- 11
Secure, secretless npm publishing CLI via GitHub OIDC
Mar 2026 · npmjs.com · its alternatives →
- 12
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com · its alternatives →
- 13
Block bad npm and pip packages. Before they download.
May 2026 · veln.sh · its alternatives →
- 14
noirdoc▲96PII guard for Claude Code to keep client data out of context
Apr 2026 · noirdoc.de · its alternatives →
- 15
envsecrets▲72CLI first management of your environment secrets
2023 · envsecrets.com · its alternatives →
- 16
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com · its alternatives →
- 17
Prune.io — available for private acquisition, represented by DomainIntake. Confidential inquiries; escrow-secured closing.
2013 · prune.io · its alternatives →
- 18
Track NPM package downloads with this free tool.
2025 · npm-downlytics.mazyar.dev · its alternatives →
- 19
CLI tools for semantic versioning based on GitHub PR labels
2019 · intuit.github.io · its alternatives →
- 20
Block AI config leaks before npm publish fires
May 2026 · packguard.kartikshukla.dev · its alternatives →
- 21ZI
2016 · zpder.herokuapp.com · its alternatives →
- 22RV
Thrilled to announce that very soon The List Of Vulnerabilities collected from multiple platforms including ( npm, Maven, Go, NuGet, PyPI, RubyGems, crates.io, Packagist, Linux, OSS-Fuzz ) will be live at https://vulert.com/vuln-list. In short we are making sure that no vulnerability is left unreported and your software/service is always protected from unexpected attacks. Who doesn’t know Vulert Yet: Vulert, without any integration, notifies you if a Security Issue is found in any of the open-source software you are relying upon. HOW DOES VULERT PROTECT YOU ? PRIVACY: You…
2022 · its alternatives →
- 23
📦️ Continuous (Preview) Releases for your libraries! - GitHub - stackblitz-labs/pkg.pr.new: 📦️ Continuous (Preview) Releases for your libraries!
2024 · github.com · its alternatives →
- 24
deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more. It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service. I built this because AI coding agents kept suggesting outdated or vulnerable package versions. I kept having to manually tell tools like Claude and Codex to use newer, safer versions. deptrust gives the agent a quick way to verify whether a…
Jul 2026 · github.com · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →