Auto-Unpublish NPM Packages Published Outside CI
A lot of vendors and open-source projects shared guidance on protecting users from downloading malicious NPM packages after the Shai-Hulud campaign — but almost nothing focused on protecting maintainers from accidentally (or maliciously) publishing them. So we built a small tool that continuously monitors your NPM packages and automatically unpublishes any version not produced by your CI workflow.
Auto-Unpublish NPM Packages Published Outside CI launched on November 27, 2025 with 6 votes, #2,995 of 9,796 launches that month and more than 75% of that year's launches.
What it does
Plugins for Tangent. Contribute to telophasehq/tangent-plugins development by creating an account on GitHub.
This is a Tangent plugin that protects your NPM organization by detecting and automatically unpublishing package versions that were not published through your approved CI workflows . Tangent is a security data pipeline built for enrichment, detection, and automation. 📘 Docs: https://docs.telophasehq.com This plugin monitors all package publishes in real time, and takes action when a version appears that wasn’t created by CI. ./setup.sh 2. Compile Plugin tangent plugin compile --config tangent.yaml 3. Run Tests tangent plugin test --config tangent.yaml 4. Run the Pipeline tangent run --config tangent.yaml Configuration In your tangent.yaml ,from github.com
Does a similar job
all alternatives →
Safe-NPM – only install packages that are +90 days oldNov 2025 · github.com · ▲90This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
npm install actual-malware2022 · github.com · ▲55Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
Publish from GitHub Actions using multi-factor authentication2022 · github.com · ▲72The backstory about this GitHub Action: I discussed with an open-source maintainer why they publish npm packages from their local machine and do not use CI/CD pipelines. They said publishing should require human intervention and want to continue using multi-factor authentication to publish to the npm registry. This led to building the wait-for-secrets GitHub Action. It prints a URL in the build log and waits for secrets to be entered using a browser. Once entered, the workflow continues, and secrets can be used in future steps. The latest release of "eslint-plugin-react" to the npm…
- AIAuto install npm dependencies as you code2016 · npmjs.com · ▲60
More dev tools this month
the category →
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 28d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 26d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 24d ago · openbot.run
Talanoa▲346Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 21d ago · talanoa.email
CoreSpeed▲332One MCP for everything your agents need: apps, memory, tools
Dev tools · 29d ago · corespeed.io
Source: Show HN post ↗
Launched alongside, November 2025
the whole month →
Guideflow▲1,338Create interactive product demos and step-by-step guides in seconds with Guideflow, the leading AI-powered demo automation tool.
AI · Nov 2025 · guideflow.com
Hardware and software projects by Ali Roberts
Life & fun · Nov 2025 · bitsnpieces.dev
Welltory▲1,028Measure your wellness. Use data to feel great every day.
Work · Nov 2025 · welltory.com
TrustMRR▲833LLM Gateway is a b2b artificial intelligence based in United States, founded in 2025. $259,539/month in verified Stripe revenue. $78,764 MRR. Ahrefs Domain Rating 52/100. growing 55% month-over-month. Track LLM Gateway's verified metrics on TrustMRR.
Growth · Nov 2025 · trustmrr.com
Boing▲782Life & fun · Nov 2025 · boing.greg.technology