Dev tools · alternatives · 2026
24 alternatives to Mitigate against 0-day supply chain attacks with safe-NPM
safe npm time travel installs. Contribute to stagas/safe-npm development by creating an account on GitHub.
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Mitigate against 0-day supply chain attacks with safe-NPM launched in 2022; newer entries below may have overtaken it.
- 1
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com · its alternatives →
- 2
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
2025 · github.com · its alternatives →
- 3
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com · its alternatives →
- 4
- 5
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com · its alternatives →
- 6
Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
2022 · socket.dev · its alternatives →
- 7
🚀 Realtime Monitoring solution for Node.js/Express.js apps, inspired by status.github.com, sponsored by https://dynobase.dev - RafalWilinski/express-status-monitor
2016 · github.com · its alternatives →
- 8
DepsGuard▲10Configure once, prevent the next compromised package install
May 2026 · depsguard.com · its alternatives →
- 9
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com · its alternatives →
- 10AI
2016 · npmjs.com · its alternatives →
- 11
- 12
Type safe promises in go. Contribute to garlicnation/promises development by creating an account on GitHub.
2019 · github.com · its alternatives →
- 13
- 14
- 15
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs. In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node. It currently protects against: - Unauthorized file system access - Unauthorized network access - Unauthorized command execution - (by way of exec/spawn) I just released the first beta version of the library and I'd love to hear what you guys think. Note: Protection is still…
2022 · github.com · its alternatives →
- 16TD
Trusty - Search for an open source package to understand its trustworthiness based on activity, provenance, and more. Brought to you by the founders of projects such as Kubernetes and Sigstore. Hey, Luke here the CTO of stacklok. This is an early experimental preview of Trusty. We use statistical analysis to observe millions of packages and found that Malware typically follows certain patterns. We found this tool really useful to help understand the packages we our pulling into our software and wanted to share it with others. It's still early in and we have a lot more features that will be…
2023 · trustypkg.dev · its alternatives →
- 17
stats for npm. Contribute to jaxgeller/npm-stats development by creating an account on GitHub.
2015 · bit.ly · its alternatives →
- 18
Safeguard & Self-Heal your Software Supply Chain (Zero Days)
Aug 2026 · safeguard.sh · its alternatives →
- 19
Here you can find some insights into GitHub real-time contribution, including pull request events grouped by programming languages, top 5 active repositories and developers last 24 hours.
2022 · live.ossinsight.io · its alternatives →
- 20
Discover Protect.js, the revolutionary tool that simplifies secure, data-driven application development using state-of-the-art encryption and ZeroKMS. Protect sensitive data in just 15 minutes.
2025 · cipherstash.com · its alternatives →
- 21
- 22
Production-ready FastAPI + React boilerplate with authentication, Stripe payments, and Docker deployment. Launch your MVP in hours, not months. Save 90+ hours of development time with our battle-tested SaaS starter kit.
2024 · craftyourstartup.com · its alternatives →
- 23
Track npm downloads, package safety & live stats
Dec 2025 · npm.watch · its alternatives →
- 24
Launch your SaaS at warp speed with Gravity — the most trusted Node.js & React boilerplate, used by 1100+ developers.
2021 · usegravity.app · its alternatives →
Also compare
- Safe-NPM – only install packages that are +90 days old alternatives
- Tips to stay safe from NPM supply chain attacks alternatives
- Safe-install – safer NPM installs with trusted build dependencies alternatives
- Socket alternatives
- npm install actual-malware alternatives
- Socket – Secure your JavaScript supply chain alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →