Mitigate against 0-day supply chain attacks with safe-NPM
safe npm time travel installs. Contribute to stagas/safe-npm development by creating an account on GitHub.
Mitigate against 0-day supply chain attacks with safe-NPM launched on March 25, 2022 with 5 votes, #1,399 of 3,153 launches that month and more than 50% of that year's launches. The site was still online in September 2026, 4 years on.
Does a similar job
all alternatives →
Safe-NPM – only install packages that are +90 days oldNov 2025 · github.com · ▲90This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Tips to stay safe from NPM supply chain attacks2025 · github.com · ▲96Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
Safe-install – safer NPM installs with trusted build dependenciesMay 2026 · npmjs.com · ▲19In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
npm install actual-malware2022 · github.com · ▲55Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
Socket – Secure your JavaScript supply chain2022 · socket.dev · ▲133Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
More dev tools this month
the category →
Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.
Dev tools · 20h ago · github.com
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 29d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 27d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 24d ago · openbot.run
Talanoa▲346Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 22d ago · talanoa.email
Source: Show HN post ↗
Launched alongside, March 2022
the whole month →- IM
Hi HN! I made many small web games in the past with Unity or Phaser. But this time I wanted to make something completely on my own. So I coded a basic game framework in plain JavaScript, and used it to make Almost Pong. This was a really fun project that taught me a lot about JavaScript, and I plan to make more minimalist games with this framework. Interesting fact: Almost Pong doesn't load any assets, all sprites and sounds are generated with code. Happy to answer questions, and please let me know if you have any feedback on the game. Thanks!
Dev tools · 2022 · lessmilk.com
- IM
Life & fun · 2022 · networksfromscratch.com
- HA
Paste the following into the console of any HN page - for annotated avatars on all HN comments. (self contained code) for(u of document.querySelectorAll('.hnuser'))for(u.prepend(c=document.createElement('canvas')),x=c.getContext('2d'),c.width=18,c.height=14,s=u.innerText,r=1,i=28+s.length;i--;i>>29>X*X/3+Y/2&&x.fillRect(6+2*X,2*Y,2,2)&x.fillRect(6-2*X,2*Y,2,2):r+=s.charCodeAt(i-28,x.fillStyle='#'+(r>>8&0xFFFFFF).toString(16)))r^=r>>17,r^=r>2
Dev tools · 2022
How well do you know your area? Test your knowledge by locating streets on a map.
Work · 2022 · backofyourhand.com