Dev tools · alternatives · 2026
24 alternatives to DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configs
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
DepsGuard is a command-line tool that automatically hardens security configurations across npm, pnpm, yarn, bun, and uv package managers. It sets minimum release ages for dependencies and disables install scripts in a… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
DepsGuard▲10Configure once, prevent the next compromised package install
May 2026 · depsguard.com · its alternatives →
- 2
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com · its alternatives →
- 3
- 4
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
2025 · github.com · its alternatives →
- 5
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com · its alternatives →
- 6
I'm a software engineer who keeps getting pulled into DevOps no matter how hard I try to escape it. I recently moved into a Lead DevOps Engineer role writing tooling to automate a lot of the pain away. On my own time outside of work, I built Artifact Keeper — a self-hosted artifact registry that supports 45+ package formats. Security scanning, SSO, replication, WASM plugins — it's all in the MIT-licensed release. No enterprise tier. No feature gates. No surprise invoices. Your package managers — pip, npm, docker, cargo, helm, go, all of them — talk directly to it using their native…
Feb 2026 · github.com · its alternatives →
- 7
Lockdown your linux install. The simple zero config linux hardening script - dolegi/lockdown.sh
2020 · github.com · its alternatives →
- 8
🚀 Fast and simple Node.js version manager, built in Rust - Schniz/fnm
2019 · github.com · its alternatives →
- 9
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com · its alternatives →
- 10AI
2016 · npmjs.com · its alternatives →
- 11
FAST command to manage a centralised wireguard VPN. Think wg-quick but quicker: key generation + address allocation. - naggie/dsnet
2020 · github.com · its alternatives →
- 12
Hey HN, the is Chris, creator of FireDBG. We’ve been working on this debugger just about a year now. Time travel debugging isn’t a new concept, the new idea here is to use call tree visualisation to help us navigate the debug trace. It supports various Linux distros on x64 and macOS on x64 and M1. It’s only available for Rust right now, but we do want to bring this debugging experience to other programming languages. Please give it a try! Would love to know your thoughts. What’s your anecdote in debugging programs? My stupidity is usually in the form of: after a few hours of debugging, I…
2023 · firedbg.sea-ql.org · its alternatives →
- 13
DebOps - Your Debian-based data center in a box. Contribute to debops/debops development by creating an account on GitHub.
2019 · github.com · its alternatives →
- 14
- 15
Rev-dep is a dependency analysis and optimization CLI for JavaScript and TypeScript projects. It helps answer questions like: where is this file used, what are the entry points, are there circular dependencies, and which files or node_modules are unused. I recently rewrote it from scratch in Go to focus on performance and low memory usage. On large codebases (500k+ LOC), circular dependency detection runs in a few hundred milliseconds and is up to 175x faster than Madge in my benchmarks. Feature-wise it overlaps partially with tools like madge, dpdm, skott, and dependency-cruiser, but aims…
Feb 2026 · github.com · its alternatives →
- 16
Block bad npm and pip packages. Before they download.
May 2026 · veln.sh · its alternatives →
- 17
Hi HN! We are excited to show you modguard - a Python tool we built to enforce a modular, decoupled package architecture. We built modguard to solve a recurring problem that we've experienced on software teams - code sprawl. Over time, cross-module imports would tightly couple together what used to be independent domains, and eventually create "balls of mud". This made it harder to test, and harder to make changes. Mis-use of modules which were intended to be private would then degrade performance and even cause security incidents. This would happen for a variety of reasons: - Junior…
2024 · github.com · its alternatives →
- 18
A tiny dependency manager for modern browsers (992 bytes) - muicss/johnnydepp
2018 · github.com · its alternatives →
- 19
- 20
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs. In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node. It currently protects against: - Unauthorized file system access - Unauthorized network access - Unauthorized command execution - (by way of exec/spawn) I just released the first beta version of the library and I'd love to hear what you guys think. Note: Protection is still…
2022 · github.com · its alternatives →
- 21
Linter for dangerous Postgres migration patterns in Diesel and SQLx. Prevents downtime caused by unsafe schema changes. - ayarotsky/diesel-guard
Dec 2025 · github.com · its alternatives →
- 22OS
2024 · defguard.net · its alternatives →
- 23
NPM install configuration in top of YAML for fast usage.
2021 · github.com · its alternatives →
- 24
bunpm▲4npm, yarn, pnpm - same commands, powered by Bun underneath
Jul 2026 · github.com · its alternatives →
Also compare
- DepsGuard alternatives
- Safe-NPM – only install packages that are +90 days old alternatives
- DepsHub alternatives
- Tips to stay safe from NPM supply chain attacks alternatives
- Safe-install – safer NPM installs with trusted build dependencies alternatives
- Artifact Keeper – Open-Source Artifactory/Nexus Alternative in Rust alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →