Alternatives
Products that do what DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configs does
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
- 1
- 2SN
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com
- 3
- 4
- 5TT
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
Sep 2025 · github.com
- 6SI
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com
- 7AK
I'm a software engineer who keeps getting pulled into DevOps no matter how hard I try to escape it. I recently moved into a Lead DevOps Engineer role writing tooling to automate a lot of the pain away. On my own time outside of work, I built Artifact Keeper — a self-hosted artifact registry that supports 45+ package formats. Security scanning, SSO, replication, WASM plugins — it's all in the MIT-licensed release. No enterprise tier. No feature gates. No surprise invoices. Your package managers — pip, npm, docker, cargo, helm, go, all of them — talk directly to it using their native…
Feb 2026 · github.com
- 8LD
Hi HN! We’re Adrien and Kanav. We met at our previous job, where we spent about a third of our lives combating a constant firehose of bugs. In the hope of reducing this pain for others in the future, we’re working on automating debugging. We’re currently working on a platform that ingests logs and then automatically reproduces, root causes and ultimately fixes production bugs as they happen. You can see some of our work on this here - https://news.ycombinator.com/item?id=39528087 As we were building the root-cause phase of our automated debugger, we realized that we developed…
2024 · github.com
- 9MA
I've invented a new alternative to forking / vendoring / monkey-patching packages in Python. It's a bit like OverlayFS for Python modules - it allows you write modifications for a target module (lower) in a new module (upper), and have these combined in a new virtual module (mount). It works by rewriting imports using AST transformations, then running both the lower and upper module's code in the new Python module. This prevents polluting the global namespace when monkey-patching, and means if you want to make changes to a third-party package, you don't have to take on the…
Oct 2025 · github.com
- 10NI
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com
- 11FA
Hey HN, the is Chris, creator of FireDBG. We’ve been working on this debugger just about a year now. Time travel debugging isn’t a new concept, the new idea here is to use call tree visualisation to help us navigate the debug trace. It supports various Linux distros on x64 and macOS on x64 and M1. It’s only available for Rust right now, but we do want to bring this debugging experience to other programming languages. Please give it a try! Would love to know your thoughts. What’s your anecdote in debugging programs? My stupidity is usually in the form of: after a few hours of debugging, I…
2023 · firedbg.sea-ql.org
- 12QT
2017 · github.com
- 13IG
Hey HN, For years, my local development setup has been a fragile mess of tools that never quite played nicely together. On my mac, it was a constant battle with Homebrew services starting (or not starting) on boot, conflicting PHP and Node versions managed by `asdf` or `nvm`, and a collection of `docker-compose.yml` files that I'd copy-paste and tweak for every single project. The cognitive load was just too high. Setting up SSL was another chore involving `mkcert`. Sharing a quick demo with a colleague meant firing up ngrok. And if I wanted to run two projects that needed different versions…
Oct 2025 · servbay.com
- 14SV
Hi HN, I've been waiting to post what I've been working on for a few weeks now:) Today we're launching LayerVault, which is a version control system made for designers. The URL is http://www.layervault.com LayerVault keeps track of what you're working on without adding extra steps to your process. The app runs in your toolbar and tracks changes you make to your files. Basically — each time you create or modify a file you’re working on, LayerVault saves a copy. You can then login, flip through its versions, and download a version from a few weeks ago. It's pretty neat — and we’ve built some…
2011
- 15
- 16
Block bad npm and pip packages. Before they download.
May 2026 · veln.sh
- 17MA
Hi HN! We are excited to show you modguard - a Python tool we built to enforce a modular, decoupled package architecture. We built modguard to solve a recurring problem that we've experienced on software teams - code sprawl. Over time, cross-module imports would tightly couple together what used to be independent domains, and eventually create "balls of mud". This made it harder to test, and harder to make changes. Mis-use of modules which were intended to be private would then degrade performance and even cause security incidents. This would happen for a variety of reasons: - Junior…
2024 · github.com
- 18BA
I found hping3 and nmap's nping to be far too slow in terms of sending individual, bare-minimum (40-byte) TCP SYN packets; other than inefficient socket I/O, they were also attempting to do far too much unnecessary processing in what should have otherwise been a tight execution loop. Furthermore, none of them were able to handle CIDR notations (i.e., a range of IP addresses) as their source IP parameter. Being intended for embedded devices (e.g., low-power MIPS/Arm-based routers), Blitzping only depends on standard POSIX headers and C11's libc (whether musl or gnu). To that end,…
2024 · github.com
- 19HR
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs. In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node. It currently protects against: - Unauthorized file system access - Unauthorized network access - Unauthorized command execution - (by way of exec/spawn) I just released the first beta version of the library and I'd love to hear what you guys think. Note: Protection is still…
2022 · github.com
- 20OS
2024 · defguard.net
- 21
- 22CM
I use Claude Code across multiple projects with different conventions and some shared repos just as it so happens to be the real world. Managing the config files (.claude/rules/, mcps.json, settings.json) by hand got tedious, so I built a local web UI for it. This one started out as claude-config but migrated to coder-config as I'm adding others (Gemini, AG, Codex, etc). Main features: - Visual editor for rules, permissions, and MCP servers - Project registry to switch between codebases - "Workstreams" to group related repos (frontend + API + shared libs) with shared context -…
Jan 2026 · github.com
- 23GP
Hey HN, Every team I've been on has cobbled together some sort of combination of GitHub branch protections and custom scripts to make sure that PRs conform to organization policies and best practices. Things like: - When {X} file is changed, require review from team {Y} - When a new db migration is added, ensure that a special set of tests pass - Require multiple approvals when the PR is very large - Add a special label to PRs that include breaking changes - Allow emergencies / hotfixes to break glass and bypass all of the above Most teams tend to start out with a little script running…
2025 · gitguard.dev
- 24DG
Dec 2025 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →