Hagana – Runtime protection for Node.js to block supply chain attacks
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs. In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node. It currently protects against: - Unauthorized file system access - Unauthorized network access - Unauthorized command execution - (by way of exec/spawn) I just released the first beta version of the library and I'd love to hear what you guys think. Note: Protection is still…
Hagana – Runtime protection for Node.js to block supply chain attacks launched on June 22, 2022 with 11 votes, #966 of 3,005 launches that month and more than 75% of that year's launches. The site was still online in September 2026, 4 years on.
In plain words
Hagana is a Node.js runtime protection library designed to defend against supply chain attacks from compromised npm packages. It blocks unauthorized file system access, network connections, and command execution attempts. The tool is intended for developers concerned about malicious code in their dependencies. It currently protects running applications but does not yet cover post-install or pre-install scripts.
written from the facts on this page · September 2026
From the sources
NodeJS runtime protection for supply chain attacks - yaakov123/hagana
In the maker’s words, at launch
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs. In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node.…
Does a similar job
all alternatives →
Tips to stay safe from NPM supply chain attacks2025 · github.com · ▲96Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
Socket – Secure your JavaScript supply chain2022 · socket.dev · ▲133Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
Safe-NPM – only install packages that are +90 days oldNov 2025 · github.com · ▲90This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configsJun 2026 · github.com · ▲40I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
More dev tools this month
the category →
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 28d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 26d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 23d ago · openbot.run
Talanoa▲346Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 21d ago · talanoa.email
CoreSpeed▲332One MCP for everything your agents need: apps, memory, tools
Dev tools · 29d ago · corespeed.io
Source: Show HN post ↗ · launch text quoted in part
Launched alongside, June 2022
the whole month →- AF
I've seen some interests in (simulation) video games here on HN so I thought I'd share a short version of our story. More than 6 years ago, me and my friend from university were playing around with an idea of making a game we always wanted to play. We worked on it on weekends but the progress was quite slow, especially due to so many dead ends and wasted effort. Eventually however, we solidified our direction and decided to take the risk to resign from our well paid SWE jobs and work on it full time. It took more than a year but yesterday we have finally released it on Steam:…
Life & fun · 2022
Life & fun · 2022 · benoitessiambre.com
min(DALL·E) is a fast, minimal port of DALL·E Mini to PyTorch - kuprel/min-dalle
Life & fun · 2022 · github.com
MakerBox▲621600 tools with generous free plans for indie entrepreneurs
Dev tools · 2022 · makerbox.club
Typedream CMS▲593Display your Notion data beautifully on your site, no-code
Dev tools · 2022 · typedream.com