Dev tools · alternatives · 2026
24 alternatives to Safe-NPM – only install packages that are +90 days old
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Safe-NPM is a command-line tool that reduces exposure to compromised npm packages by only installing versions that have been publicly available for at least 90 days. It queries the npm registry for matching package… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com · its alternatives →
- 2
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
2025 · github.com · its alternatives →
- 3
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com · its alternatives →
- 4
safe npm time travel installs. Contribute to stagas/safe-npm development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 5
Hi HN! Thanks for your attention to my post. It was a big challenge to run most of Node.js packages in browser, fast moreover. Virtual File system, resolve import/export. I got cold many times, depressions, burned out, yet still alive and finished it. Many guys helped me with an advice. Many users give a lot of positive feedback. There are 200,000 monthly unique users. I work full time now because of the freemium business model. To be honest - I am happy after many years of hard work.
2022 · playcode.io · its alternatives →
- 6
Offline-first, highly scalable foundation for your next app
2016 · github.com · its alternatives →
- 7
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com · its alternatives →
- 8
- 9AI
2016 · npmjs.com · its alternatives →
- 10
DepsGuard▲10Configure once, prevent the next compromised package install
May 2026 · depsguard.com · its alternatives →
- 11
A tool to help developers stay safe with npm dependencies.
Feb 2026 · package-sentinel.vercel.app · its alternatives →
- 12
Block bad npm and pip packages. Before they download.
May 2026 · veln.sh · its alternatives →
- 13
EasyNPM▲108Search & install command with one-click for npm packages
2023 · easynpm.netlify.app · its alternatives →
- 14
The backstory about this GitHub Action: I discussed with an open-source maintainer why they publish npm packages from their local machine and do not use CI/CD pipelines. They said publishing should require human intervention and want to continue using multi-factor authentication to publish to the npm registry. This led to building the wait-for-secrets GitHub Action. It prints a URL in the build log and waits for secrets to be entered using a browser. Once entered, the workflow continues, and secrets can be used in future steps. The latest release of "eslint-plugin-react" to the npm…
2022 · github.com · its alternatives →
- 15
Monitor NuGet and NPM packages in your repositories
2021 · its alternatives →
- 16
High performance secure & portable Rust functions in Node.js
2020 · secondstate.io · its alternatives →
- 17
- 18
Hey HN, I'm Arjun, an 18-year-old intern at Socket. I've been working on a project that I'm really excited to share with you all - a browser extension that makes it easier to check the security of NPM packages before you use them. You can try the extension on any Chromium-based browser or on Firefox. Chrome extension: https://chrome.google.com/webstore/detail/socket-security/jb... Firefox add-on: https://addons.mozilla.org/en-US/firefox/addon/socket-securi... Socket scans NPM packages for malware, vulnerabilities, code smell, and…
2023 · chrome.google.com · its alternatives →
- 19
A React Framework for building internal tools, admin panels, dashboards & B2B apps with unmatched flexibility. - refinedev/refine
2022 · github.com · its alternatives →
- 20
A lot of vendors and open-source projects shared guidance on protecting users from downloading malicious NPM packages after the Shai-Hulud campaign — but almost nothing focused on protecting maintainers from accidentally (or maliciously) publishing them. So we built a small tool that continuously monitors your NPM packages and automatically unpublishes any version not produced by your CI workflow.
Nov 2025 · github.com · its alternatives →
- 21
Host private Python, Docker, NPM, Debian, and Conda packages. Private package registry with 4.5x faster installs, CVE scanning, and SSO. Up to 80% cheaper than Cloudsmith. Free tier available.
2019 · packagr.app · its alternatives →
- 22
Next.js has APIs to read and update search params (the /?foo=bar part of the URL), but they lack type-safety for consistent keys and proper parsing/serializing of JS data types. I found myself repeatedly building the same custom hook to get a React.useState-like approach. In 2021, I published it to NPM and then forgot about it. Since then, the `nuqs` package has gained popularity and is now used by companies like Vercel, Auth.js, Gitbook, and Midday.ai, with 200K weekly downloads. It's been fun building this as a side project and automating as much as possible to ensure a…
2024 · nuqs.47ng.com · its alternatives →
- 23
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs. In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node. It currently protects against: - Unauthorized file system access - Unauthorized network access - Unauthorized command execution - (by way of exec/spawn) I just released the first beta version of the library and I'd love to hear what you guys think. Note: Protection is still…
2022 · github.com · its alternatives →
- 24
jpm installs npm packages fast, from one ~2 MB binary, with dependencies
20d ago · getjpm.sh · its alternatives →
Also compare
- Safe-install – safer NPM installs with trusted build dependencies alternatives
- Tips to stay safe from NPM supply chain attacks alternatives
- npm install actual-malware alternatives
- Mitigate against 0-day supply chain attacks with safe-NPM alternatives
- I've been making JavaScript sandbox alone for 6 years alternatives
- React Boilerplate 3.0 alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →