Dev tools · alternatives · 2026
24 alternatives to npm Trusted Publisher
Secure, secretless npm publishing CLI via GitHub OIDC
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
The backstory about this GitHub Action: I discussed with an open-source maintainer why they publish npm packages from their local machine and do not use CI/CD pipelines. They said publishing should require human intervention and want to continue using multi-factor authentication to publish to the npm registry. This led to building the wait-for-secrets GitHub Action. It prints a URL in the build log and waits for secrets to be entered using a browser. Once entered, the workflow continues, and secrets can be used in future steps. The latest release of "eslint-plugin-react" to the npm…
2022 · github.com · its alternatives →
- 2
Phase▲383Open source platform for teams and AI agents to securely access, manage and deploy application secrets — from development to production.
2024 · phase.dev · its alternatives →
- 3
Nitric Deploy▲197The right infrastructure, auto-provisioned in your cloud
2022 · nitric.io · its alternatives →
- 4
- 5
Skip migration and launch MCP with built-in Auth
Nov 2025 · arcade.dev · its alternatives →
- 6
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
2025 · github.com · its alternatives →
- 7
keychains.dev▲177Hi HN — I’m a heavy OpenClaw user and, like many others, I’ve been thinking about how to give these new “unleashed” agents secure access to my accounts. Agents need API access to be useful. But API keys are long-lived secrets. And agents are not secure environments. So I built something for myself that quickly turned into a product: keychains.dev. The idea is simple: agents never see raw credentials. With Keychains.dev: • Agents make API calls via a drop-in replacement for curl or JavaScript’s fetch() • They use template variable names instead of embedding credentials • The request is…
Feb 2026 · keychains.dev · its alternatives →
- 8
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com · its alternatives →
- 9
OpenBerth▲84Deploy AI-generated apps to your own server with one command. Open source, sandboxed, automatic HTTPS. Built for non-engineers.
Apr 2026 · openberth.io · its alternatives →
- 10
I built this as a small side project to learn and experiment, and I ended up with this! I used a subdomain from my personal portfolio, and everything else runs on free tiers. The project uses Nuxt, SVG, Cloudflare Workers, D1 (SQL), KV, Terraform, and some agentic coding with OpenAI Codex and Claude Code. What started as a joke among friends turned into a fun excuse to build something end to end, from zero to production, and to explore a few things I’d never touched before. I’d really appreciate any feedback or suggestions.
Jan 2026 · certificate.brendonmatos.com · its alternatives →
- 11AI
2016 · npmjs.com · its alternatives →
- 12IM
2021 · zentrum.alles.cx · its alternatives →
- 13
Hey, we built an open-source CLI in Go purposed to help you answer security questions across your cloud, code and runtime. It connects to your GitHub, GitLab, AWS, GCP, Azure & K8s using the credentials that are already in your shell, while limiting itself to read-only. The core innovation here is the trust boundary - our agent has a built-in code execution sandbox with no host or network access; it is exposed to an internal tool which we call an “action gate” that performs read-only HTTP requests to your own infrastructure. Since the cloud providers constantly expand actions and services,…
Jul 2026 · github.com · its alternatives →
- 14
envsecrets▲72CLI first management of your environment secrets
2023 · envsecrets.com · its alternatives →
- 15
Hi Hacker News! Shahar and Tal from Keep Here. We were tired of creating alerts for our applications, so we've built an open-source GitHub Bot that lets you write application alerts using plain English. The code is open-sourced: https://github.com/keephq/keep so you can review it yourself. Every developer and DevOps professional is familiar with the fact that in order to ensure your application works in production, you need to access your observability tool's user interface (such as Grafana, Datadog, New Relic, etc.) and carefully determine how to create alerts that…
2023 · github.com · its alternatives →
- 16
2015 · github.com · its alternatives →
- 17
A lot of vendors and open-source projects shared guidance on protecting users from downloading malicious NPM packages after the Shai-Hulud campaign — but almost nothing focused on protecting maintainers from accidentally (or maliciously) publishing them. So we built a small tool that continuously monitors your NPM packages and automatically unpublishes any version not produced by your CI workflow.
Nov 2025 · github.com · its alternatives →
- 18
Prune.io — available for private acquisition, represented by DomainIntake. Confidential inquiries; escrow-secured closing.
2013 · prune.io · its alternatives →
- 19
One command to a publish-ready TypeScript CLI
2025 · github.com · its alternatives →
- 20
Free and open source, npflared is a serveless private npm registry that you can self-host in order to distribute private packages for you and your team
2024 · npflared.thomas-cogez.fr · its alternatives →
- 21
I tend to create a private certificate authority for every side project, in order to create TLS certs for local development. I find it useful to have local development closely resemble production when at all possible, and "real" certificates are an important element. Anyway I got tired of having these CA private keys on my local machine, especially as I started thinking about setting up a private CA for my company (https://riza.io). So I started thinking about what the simplest way to host a private CA might be. You really only need two things: 1) secret storage, to hold the CA's…
2024 · github.com · its alternatives →
- 22
Self-hosted CI without the CI platform.
Sep 2026 · openpreflight.xyz · its alternatives →
- 23
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com · its alternatives →
- 24
The open-source AIOps and alert management platform - keephq/keep
2023 · github.com · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →