Alternatives
Products that do what Hagana – Runtime protection for Node.js to block supply chain attacks does
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs. In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node. It currently protects against: - Unauthorized file system access - Unauthorized network access - Unauthorized command execution - (by way of exec/spawn) I just released the first beta version of the library and I'd love to hear what you guys think. Note: Protection is still…
- 1TT
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
Sep 2025 · github.com
- 2SS
Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
2022 · socket.dev
- 3
- 4
- 5IV
Hi HN! Thanks for your attention to my post. It was a big challenge to run most of Node.js packages in browser, fast moreover. Virtual File system, resolve import/export. I got cold many times, depressions, burned out, yet still alive and finished it. Many guys helped me with an advice. Many users give a lot of positive feedback. There are 200,000 monthly unique users. I work full time now because of the freemium business model. To be honest - I am happy after many years of hard work.
2022 · playcode.io
- 6SN
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com
- 7JT
2024 · github.com
- 8DO
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com
- 9
- 10NI
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com
- 11
- 12AC
We needed something like --dangerously-skip-permissions that doesn’t nuke your untracked files, exfiltrate your keys, or install malware. Claude Code's permission system is allow-or-deny per tool, but that doesn’t really scale. Deleting some files is fine sometimes. And git checkout is sometimes not fine. Even when you curate permissions, 200 IQ Opus can find a way around it. Maintaining a deny list is a fool's errand. nah is a PreToolUse hook that classifies every tool call by what it actually does, using a deterministic classifier that runs in milliseconds. It maps commands to action types…
Mar 2026 · github.com
- 13AO
This is a small PoC Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on. We'll be happy to gather initial feedback on usability and features, especialy from people having good or bad experience wit bots. *Requirements* The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators: 1. JA5 client fingerprinting (https://tempesta-tech.com/knowledge-base/Traffic-Filtering-b...). This is a HTTP and TLS layers…
Oct 2025 · github.com
- 14WP
2016 · wallarm.com
- 15SJ
Hey HN, I'm the maintainer of node-cron (5M+ downloads/month), and I recently built Sidequest.js, a background job runner for Node.js inspired by Oban (Elixir) and Sidekiq (Rails). It solves some common problems I saw with libraries like node-cron: - Jobs don’t block your API: they run in isolated worker threads - No Redis or vendor lock-in: use Postgres, MySQL, SQLite, or MongoDB - Supports retries, uniqueness, concurrency, snoozing, prioritization - Comes with a CLI and a simple dashboard - Works great in monoliths and doesn’t require extra infra Quick start (no signup needed):…
2025 · docs.sidequestjs.com
- 16SI
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com
- 17PI
People seem to be blindly hooking up their OpenClaw’s to their personal data. So, I built runtime controls to prevent at the least, very simple prompt injection attacks. Once installed, it hooks to Node.js child_process module in the gateway process and listens to tool calls and their response streams. And a fetch hook to monitor user prompts (both could’ve been through fetch, happy to discuss why this whole layer couldn’t just be a proxy). There are two layers of protection: First: Whenever there is a read-only tool call whose response an attacker can modify, we extract that part of the…
Feb 2026 · github.com
- 18TJ
Hi HN, I built Titan, a backend framework where you write routes and logic in JavaScript, and the CLI compiles everything into a single Rust + Axum binary using the Boa JS engine. No Node.js is required in production. The idea is to keep JS developer experience while getting Rust performance and a self-contained deployable server. Current features: JS route DSL Action system mapped to Rust esbuild bundling Generated Rust server with Axum Hot-reload dev server Single-binary output Repo: https://github.com/ezet-galaxy/-ezetgalaxy-titan Would love feedback on the…
Dec 2025 · npmjs.com
- 19SW
Hey HN, I'm Arjun, an 18-year-old intern at Socket. I've been working on a project that I'm really excited to share with you all - a browser extension that makes it easier to check the security of NPM packages before you use them. You can try the extension on any Chromium-based browser or on Firefox. Chrome extension: https://chrome.google.com/webstore/detail/socket-security/jb... Firefox add-on: https://addons.mozilla.org/en-US/firefox/addon/socket-securi... Socket scans NPM packages for malware, vulnerabilities, code smell, and…
2023 · chrome.google.com
- 20RR
I wanted a safer alternative to RegExp for TypeScript that uses a linear-time engine, so I built Regolith. Why: Many CVEs happen because TypeScript libraries are vulnerable to Regular Expression Denial of Service attacks. I learned about this problem while doing undergraduate research and found that languages like Rust have built-in protection but languages like JavaScript, TypeScript, and Python do not. This library attempts to mitigate these vulnerabilities for TypeScript and JavaScript. How: Regolith uses Rust's Regex library under the hood to prevent ReDoS attacks. The Rust Regex library…
2025 · github.com
- 21AM
I made an open source, MIT license Typescript library based on some of the latest research that generates prompt injection attacks. It is a super minimal/lightweight and designed to be super easy to use. Keen to hear your thoughts and please be responsible and only pen test systems where you have permission to pen test!
2025 · prompt-injector.blueprintlab.io
- 22DL
After yesterday's release of Deno with package.json support[0] some discussions about how Deno handles dependencies have been coming up again. Since Deno's inception, I've mostly been watching it from the sidelines, dabbling a bit with it, and mostly been considering it a fad that will die out sooner or later. Ultimately, with the new package.json support nothing really changed regarding the dependency management story of Deno. It's still as awful as ever. Prompted by some discussions, I decided I would try to test how easy it would be to mount a typo-domain supply chain attack. And as…
2023
- 23SQ
TL;DR- Libninja will generate world-class client libraries for you, without you needing to fiddle with openapi-generator, maintain build pipelines, and so forth. If you just want Rust, reach out, and I'll create your client library at no cost, because I want to help Rust's ecosystem grow. -- Hi HN, I got into Rust in a big way about 9 months ago. While the language is quickly maturing, one large gap in the ecosystem is immature or non-existent client libraries for common API services like Plaid, Stripe, Twilio, Github, Slack, and so on. The existing openapi-generator templates create Rust…
2022 · libninja.com
- 24
Ranked by how close each launch is in meaning, then by votes. Refine with a description →