DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configs

In plain words

DepsGuard is a command-line tool that automatically hardens security configurations across npm, pnpm, yarn, bun, and uv package managers. It sets minimum release ages for dependencies and disables install scripts in a single command, eliminating the need to manually edit multiple config files in different formats. The tool is designed for developers who want to reduce supply chain attack risks but find the configuration process tedious or complicated.

written from the facts on this page · September 2026

From the sources

Harden your package manager configs against supply chain attacks. - arnica/depsguard

In the maker’s words, at launch

I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up…

• 
  DepsGuardMay 2026 · depsguard.com · ▲10

  Configure once, prevent the next compromised package install

• 
  Safe-NPM – only install packages that are +90 days oldNov 2025 · github.com · ▲90

  This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…

• 
  Tips to stay safe from NPM supply chain attacks2025 · github.com · ▲96

  Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!

• 
  Safe-install – safer NPM installs with trusted build dependenciesMay 2026 · npmjs.com · ▲19

  In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…

• 
  Lockdown.sh Simple shell script for locking down new linux installs2020 · github.com · ▲51

  Lockdown your linux install. The simple zero config linux hardening script - dolegi/lockdown.sh

• 
  npm install actual-malware2022 · github.com · ▲55

  Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware

• 
  Run full iOS 16.5 firmware on Android Devices▲515

  Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.

  Dev tools · 1d ago · github.com

• 
  /dev/null▲492

  a social network for devs

  Dev tools · 4d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 29d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 27d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 24d ago · openbot.run

• 
  Talanoa▲346

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 22d ago · talanoa.email

• 
  Fundraisly▲1,537

  AI fundraising agent that finds investors and books meetings

  AI · Jun 2026 · fundraisly.com

• 
  Homebrew 6.0.0▲1,481

  Today, I’m proud to announce Homebrew 6.0.0. The most significant changes since 5.1.0 are a new tap trust security mechanism, the new faster, smaller, default internal Homebrew JSON API, sandboxing on Linux, better defaults informed by our user survey, many brew bundle improvements, improved performance and initial support for macOS 27 (Golden Gate). Happy to discuss any questions here!

  Dev tools · Jun 2026 · brew.sh

• 
  Performative-UI – A react component library of design tropes▲1,181

  Hi HN! I was super frustrated at apps like tiktok and wechat preventing me from saving or downloading the animated gifs, so I made a little tool to turn a screen recording into a slack-sized emoji. Hope you get some value from this!

  Life & fun · Jun 2026 · vorpus.github.io

• 
  Upstream▲976

  The inbox designed for humans and agents

  AI · Jun 2026 · upstream.do

• 
  Goldfish▲958

  Press Option. It knows your work and replies like you

  AI · Jun 2026 · goldfish.sh

• 
  I made Google Trends for Hacker News by indexing 18 years of comments▲822

  Search 18 years of Hacker News and chart how any topic, tool, or person trended. Overlay terms to compare their rise and fall across 45M posts and comments.

  Life & fun · Jun 2026 · hackernewstrends.com