Alternatives
Products that do what DepsGuard does
Configure once, prevent the next compromised package install
- 1DO
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com
- 2TT
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
Sep 2025 · github.com
- 3
- 4NI
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com
- 5SN
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com
- 6SI
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com
- 7
- 8SS
Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
2022 · socket.dev
- 9
- 10
- 11
- 12
- 13
Block bad npm and pip packages. Before they download.
May 2026 · veln.sh
- 14SW
2016 · npmdiscover.com
- 15PF
The backstory about this GitHub Action: I discussed with an open-source maintainer why they publish npm packages from their local machine and do not use CI/CD pipelines. They said publishing should require human intervention and want to continue using multi-factor authentication to publish to the npm registry. This led to building the wait-for-secrets GitHub Action. It prints a URL in the build log and waits for secrets to be entered using a browser. Once entered, the workflow continues, and secrets can be used in future steps. The latest release of "eslint-plugin-react" to the npm…
2022 · github.com
- 16NT
2018 · github.com
- 17FC
With recent issues with npm configuration issues it's essential that we have a tool like this to fix basic issues
May 2026 · github.com
- 18
Supply chain protection that blocks malware at install
Jun 2026 · westbayberry.com
- 19RV
Thrilled to announce that very soon The List Of Vulnerabilities collected from multiple platforms including ( npm, Maven, Go, NuGet, PyPI, RubyGems, crates.io, Packagist, Linux, OSS-Fuzz ) will be live at https://vulert.com/vuln-list. In short we are making sure that no vulnerability is left unreported and your software/service is always protected from unexpected attacks. Who doesn’t know Vulert Yet: Vulert, without any integration, notifies you if a Security Issue is found in any of the open-source software you are relying upon. HOW DOES VULERT PROTECT YOU ? PRIVACY: You…
2022
- 20AU
A lot of vendors and open-source projects shared guidance on protecting users from downloading malicious NPM packages after the Shai-Hulud campaign — but almost nothing focused on protecting maintainers from accidentally (or maliciously) publishing them. So we built a small tool that continuously monitors your NPM packages and automatically unpublishes any version not produced by your CI workflow.
Nov 2025 · github.com
- 21SW
Hey HN, I'm Arjun, an 18-year-old intern at Socket. I've been working on a project that I'm really excited to share with you all - a browser extension that makes it easier to check the security of NPM packages before you use them. You can try the extension on any Chromium-based browser or on Firefox. Chrome extension: https://chrome.google.com/webstore/detail/socket-security/jb... Firefox add-on: https://addons.mozilla.org/en-US/firefox/addon/socket-securi... Socket scans NPM packages for malware, vulnerabilities, code smell, and…
2023 · chrome.google.com
- 22
Scan and auto-fix GitHub vulnerabilities in seconds
Apr 2026 · package-helper.up.railway.app
- 23
- 24
Ranked by how close each launch is in meaning, then by votes. Refine with a description →