Alternatives
Products that do what PackageSentinel does
A tool to help developers stay safe with npm dependencies.
- 1SN
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com
- 2
- 3IM
Hello HN! I'm the creator and solo developer of Extension.js, a development tool for browser extensions with built-in support for TypeScript, WebAssembly, React, and modern JavaScript. Developers use it to spend less time configuring the compilation config or learning new frameworks and more time actually writing code. Most projects similar to Extension.js rely on some sort of abstraction or configuration to get started, making the initial development process slow given the extra learning curve and setup guidelines. By using Extension.js, adding the package to your npm scripts is all it…
2024 · github.com
- 4
- 5
- 6SI
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com
- 7NI
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com
- 8
- 9TT
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
Sep 2025 · github.com
- 10
- 11
- 12ER
Jan 2026 · albertsikkema.com
- 13RO
2016 · github.com
- 14
- 15FR
Hey HN! Christian here, cofounder and CTO of Frigade (https://www.frigade.com). Our tool helps product and engineering teams quickly build in-app experiences like getting started checklists, product tours, account upsells, and nps surveys. Basically all the little things that can help boost your product's activation and retention rates, but that you don't really want to spend the time building from scratch. We built React UI components such as , , and and combined them with a web app that you can use to control user targeting, content management, sequencing, and more. These…
2024 · frigade.com
- 16SW
2016 · npmdiscover.com
- 17
- 18X2
I finally got tired of XKCD #2347 living rent-free in my head, so I built Stacktower: a tool that takes any real package’s dependency graph and turns it into an actual tower of bricks. Along the way I had to wrestle some surprisingly spicy problems. Full blog post here: https://stacktower.io The result is half visualization tool, half love letter to the chaos of modern dependency trees. Open-source, works with PyPI, Cargo, npm, and more. Code: https://github.com/matzehuels/stacktower
Dec 2025 · stacktower.io
- 19BU
Hey HN, we are building bumpgen (https://github.com/xeol-io/bumpgen/) to remove the toil of fixing breaking changes during version bumps. bumpgen bumps your npm package version then generates the fixes to potential breaking changes. There were some interesting challenges we encountered using an LLM to fix breaking changes: [1] Finding the breaking changes → know how is a dependency used through the codebase [2] Knowing how to fix the a breaking change → know how the dependency has changed from one version to another [3] Understanding how the fix has modified existing…
2024 · github.com
- 20
- 21TE
A free, in-browser Jupyter-style notebook for TypeScript. It supports npm installs, network requests, and more—no signup or setup required. Why I Built It I wanted a simple way to test npm packages, experiment with TypeScript, and work on ideas like prompt engineering without heavy setup or local tools. Features - npm Integration: Install and use packages instantly. - Network Requests: Test APIs right in the notebook. - TypeScript Playground: Experiment, debug, and share code. It’s ideal for developers, educators, and anyone wanting a TypeScript scratch pad. Give it a try at…
2025 · typescriptnotebook.com
- 22IB
Hi HN, I built a tool [1] that resolves breaking changes when you upgrade npm packages. I know keeping my dependencies updated is good hygiene but I really have no motivations to do them. The time to fix breaking changes then validate them makes the ROI lopsided. Automating these helps me reduce the barrier to a good habit. It works on typescript and tsx projects. BYOK (bring your own GPT-4 key) for the codegen. MIT license. How does it work? - Bumps the package version, builds your project, and then runs tsc over your project to understand what breaks - Uses ts-morph [2] to create an AST of…
2024 · github.com
- 23NP
Hey guys! I just released a NPM package to integrate a visual scripting editor into any node project (React, Vue, Angular... you name it). Basically, the goal is to provide your users a way to customize, automate, create new features for your product. Just like an open-source community, but without the barrier of code. Here's the homepage of the project: https://luna-park.app And a small tutorial for visual scripting: https://luna-park.app/challenge
2023 · npmjs.com
- 24DO
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →