Alternatives
Products that do what Auto-Unpublish NPM Packages Published Outside CI does
A lot of vendors and open-source projects shared guidance on protecting users from downloading malicious NPM packages after the Shai-Hulud campaign — but almost nothing focused on protecting maintainers from accidentally (or maliciously) publishing them. So we built a small tool that continuously monitors your NPM packages and automatically unpublishes any version not produced by your CI workflow.
- 1
- 2SW
2016 · npmdiscover.com
- 3AI
2016 · npmjs.com
- 4
- 5
- 6RV
Thrilled to announce that very soon The List Of Vulnerabilities collected from multiple platforms including ( npm, Maven, Go, NuGet, PyPI, RubyGems, crates.io, Packagist, Linux, OSS-Fuzz ) will be live at https://vulert.com/vuln-list. In short we are making sure that no vulnerability is left unreported and your software/service is always protected from unexpected attacks. Who doesn’t know Vulert Yet: Vulert, without any integration, notifies you if a Security Issue is found in any of the open-source software you are relying upon. HOW DOES VULERT PROTECT YOU ? PRIVACY: You…
2022
- 7ZI
2016 · zpder.herokuapp.com
- 8CT
deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more. It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service. I built this because AI coding agents kept suggesting outdated or vulnerable package versions. I kept having to manually tell tools like Claude and Codex to use newer, safer versions. deptrust gives the agent a quick way to verify whether a…
Jul 2026 · github.com
- 9IB
Hi HN, I built a tool [1] that resolves breaking changes when you upgrade npm packages. I know keeping my dependencies updated is good hygiene but I really have no motivations to do them. The time to fix breaking changes then validate them makes the ROI lopsided. Automating these helps me reduce the barrier to a good habit. It works on typescript and tsx projects. BYOK (bring your own GPT-4 key) for the codegen. MIT license. How does it work? - Bumps the package version, builds your project, and then runs tsc over your project to understand what breaks - Uses ts-morph [2] to create an AST of…
2024 · github.com
- 10NA
2016 · npmaddict.com
- 11NK
Hi HN, We are Anil and Yilmaz from the team behind Notifier. Notifier is a macOS menu bar app that keeps track of your favorite packages and notifies you whenever a new version is available. You can currently track packages from npm, pub.dev, packagist, OpenUPM and the Unity asset store. We plan to add more package repositories very soon. Notifier can also watch your dependency manifest files to make it simple to keep track of the packages you use in your projects. We have many new features planned such as tracking software and SDK versions. We want to offer HN an early look at Notifier in…
2023 · notifier.dev
- 12UA
2017 · unpkg.com
- 13NF
2014 · vuln.pub
- 14AA
We've rolled out a feature for openbase.com that we think is a DX game changer for Node devs. Since the emergence of ECMA Script modules, it's been a continuous guessing game as to what kind of exports a package has. That's never really been discoverable without using a site like unpkg, or installing the package and inspecting package.json. Openbase now displays the ES Module support level (e.g. type of exports) on all of their package pages. We added this feature because our devs are some of the folks continually caught off guard by installing an NPM dependency only to find out it's…
2022
- 15LO
Hi HN, Martin, Nils, and Jannes here. We are building Legit, an open source version control and collaboration layer for AI agents and AI native applications. You can find the repo here https://github.com/Legit-Control/monorepo and the website here https://legitcontrol.com Over the last years, we worked on multiple developer tools and AI driven products. As soon as we started letting agents modify real files and business critical data, one problem kept showing up. We could not reliably answer what changed, why it changed, or how to safely undo it. Today, most AI…
Jan 2026
- 16
Supply chain protection that blocks malware at install
Jun 2026 · westbayberry.com
- 17IB
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
2023 · github.com
- 18OS
We’re building an open-source tool that makes it easy to expose secure, LLM-optimized APIs on top of your structured data—without manually designing endpoints or worrying about compliance. AI agents and LLM-powered applications need structured access to data, but traditional APIs and databases weren’t built with AI workloads in mind. Our tool automatically generates APIs that: - Filter out PII & sensitive data to comply with GDPR, CPRA, SOC 2, and other regulations. - Provide traceability & auditing, so AI apps aren’t black boxes, and security teams stay in control. - Optimize for AI…
2025 · github.com
- 19DA
Hey HN! Built a template for distributing AI agent skills via npm. Problem: AI coding tools (Claude Code, Cursor, Windsurf) support custom "skills" but distribution is manual - copy files to ~/.tool/skills/, repeat for updates, no versioning. Solution: Standard npm packages with lifecycle hooks: npm install -g @org/my-skill npm update -g @org/my-skill Benefits: - Semantic versioning (^1.2.0 for auto-updates) - Private registries for enterprise - Standard CI/CD integration - Discoverable on npmjs.com It's a GitHub template - fork, customize SKILL.md, publish.…
Jan 2026 · github.com
- 20
- 21
- 22
- 23
AI PDF redaction that never sends your docs to public LLMs
Jun 2026 · documentredactor.com
- 24FO
2016 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →