Alternatives
Products that do what pzx does
security vulnerability osv npm audit cve sca
- 1
- 2SS
Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
2022 · socket.dev
- 3
- 4
- 5TT
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
Sep 2025 · github.com
- 6
- 7
- 8NI
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com
- 9EJ
This TypeScript package allows you to safely execute JavaScript code within a WebAssembly sandbox using the QuickJS engine. Perfect for isolating and running untrusted code securely, it leverages the lightweight and fast QuickJS engine compiled to WebAssembly, providing a robust environment for code execution. Features - *Security*: Run untrusted JavaScript code in a safe, isolated environment. - *File System*: Can mount a virtual file system - *Custom Node Modules*: Custom node modules are mountable - *Fetch Client*: Can provide a fetch client to make http(s) calls - *Test-Runner*: Includes…
2024 · github.com
- 10SZ
We're launching SecureBuild: https://securebuild.com — a new way for open source projects and maintainers to earn revenue by partnering with and endorsing our Zero-CVE container images of their project. We’ve spent the last decade at Replicated (https://news.ycombinator.com/item?id=9841243) helping commercial and open source software vendors securely distribute their apps to enterprise environments. During that time, we saw firsthand how hard it is for maintainers to fund their work, and how increasingly demanding enterprises have become when it comes to demonstrable…
2025 · securebuild.com
- 11SO
2015 · scriptobservatory.org
- 12OA
2019 · github.com
- 13AK
2015 · appcanary.com
- 14VC
2020 · snyk.io
- 15SN
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com
- 16SU
Hi everyone, I built a runtime to isolate untrusted code using wasm sandboxes. Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems. The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible. For example, in Python we have a simple decorator:…
Feb 2026 · github.com
- 17OD
2021 · osv.dev
- 18AW
2018 · github.com
- 19
Block bad npm and pip packages. Before they download.
May 2026 · veln.sh
- 20IB
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
2023 · github.com
- 21NA
2020 · github.com
- 22IG
Hey HN, For years, my local development setup has been a fragile mess of tools that never quite played nicely together. On my mac, it was a constant battle with Homebrew services starting (or not starting) on boot, conflicting PHP and Node versions managed by `asdf` or `nvm`, and a collection of `docker-compose.yml` files that I'd copy-paste and tweak for every single project. The cognitive load was just too high. Setting up SSL was another chore involving `mkcert`. Sharing a quick demo with a colleague meant firing up ngrok. And if I wanted to run two projects that needed different versions…
Oct 2025 · servbay.com
- 23SS
2020 · secondstate.io
- 24
Supply chain protection that blocks malware at install
Jun 2026 · westbayberry.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →