DepsGuard

What it does

Prevent the next npm supply chain compromise like the GitHub, axios, @tanstack attacks from impacting you. One command to scan and fix npm, pnpm, yarn, bun, and uv configs using security best practices. Free and open source (MIT), 100% Rust, zero dependencies, brought to you by the AppSec experts at Arnica.

• DO
  DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configsJun 2026 · github.com · ▲40

  I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…

• TT
  Tips to stay safe from NPM supply chain attacksSep 2025 · github.com · ▲96

  Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!

• 
  Snyk for GitHub2016 · ▲143

  Fix vulnerabilities in Node & npm dependencies with a click.

• NI
  npm install actual-malware2022 · github.com · ▲55

  Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware

• SN
  Safe-NPM – only install packages that are +90 days oldNov 2025 · github.com · ▲90

  This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…

• SI
  Safe-install – safer NPM installs with trusted build dependenciesMay 2026 · npmjs.com · ▲19

  In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…

• 
  Dograh▲592

  The open source VAPI alternative

  Dev tools · 25d ago · dograh.com

• 
  Meridian▲530

  Don't let your work go unnoticed. Get promoted!

  Dev tools · 20d ago · meridiona.com

• 
  x1▲516

  Lovable for iPhone apps go from idea to App Store

  Dev tools · 11d ago · x1.new

• 
  Computable GPU Index (CGI)▲424

  The first open-source price index for GPU compute

  Dev tools · 10d ago · getcomputable.com

• 
  The GTM Co-Founder▲402

  Open-source GTM skills for technical founders

  Dev tools · 29d ago · gtmcofounder.com

• 
  Open-Source eInk Bike Computer▲401

  OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.

  Dev tools · 2d ago · opentrailpaper.com

• 
  Brew ▲905

  Like Claude design for email marketing

  AI · May 2026 · brew.new

• 
  Kilo Code for VS Code▲897

  Parallel agents, diff reviewer, and multi-model comparisons

  Dev tools · May 2026 · kilo.ai

• 
  StoreClaw▲805

  Grow your store profits with agents that know how to sell

  AI · May 2026 · storeclaw.ai

• 
  PollyReach▲796

  Give your agent a real number and voice to make calls.

  AI · May 2026 · pollyreach.ai

• NW
  Needle: We Distilled Gemini Tool Calling into a 26M Model▲776

  Hey HN, Henry here from Cactus. We open-sourced Needle, a 26M parameter function-calling (tool use) model. It runs at 6000 tok/s prefill and 1200 tok/s decode on consumer devices. We were always frustrated by the little effort made towards building agentic models that run on budget phones, so we conducted investigations that led to an observation: agentic experiences are built upon tool calling, and massive models are overkill for it. Tool calling is fundamentally retrieval-and-assembly (match query to tool name, extract argument values, emit JSON), not reasoning. Cross-attention…

  Life & fun · May 2026 · github.com

• FM
  Files.md – Open-source alternative to Obsidian▲730

  Dev tools · May 2026 · github.com