Dev tools · September 17, 2025
npm-daycare, an NPM proxy that filters out recent & small packages
Hey all! npm-daycare is a simple NPM proxy built on Verdaccio which filters all packages that: - are younger than 48h (it will just provide an old version instead) - have fewer than 5,000 weekly downloads https://github.com/stack-auth/npm-daycare This is in response to the recent supply chain attacks that shattered the JavaScript ecosystem [1]. It's likely not a problem that will go away any time soon, so we figured we'd build something to protect against it. Doing this on the proxy layer means it will work across the entire system, as proxies are set globally. In the…
What it does
In the maker’s words, at launch
Hey all! npm-daycare is a simple NPM proxy built on Verdaccio which filters all packages that: - are younger than 48h (it will just provide an old version instead) - have fewer than 5,000 weekly downloads https://github.com/stack-auth/npm-daycare This is in response to the recent supply chain attacks that shattered the JavaScript ecosystem [1]. It's likely not a problem that will go away any time soon, so we figured we'd build something to protect against it. Doing this on the proxy layer means it will work across the entire system, as proxies are set globally. In the future, we could also add more filters to the proxy. To get started, just run the Docker container: docker run -d --rm --name npm-daycare -p 4873:4873 bgodil/npm-daycare npm set registry http://localhost:4873/ pnpm config set registry http://localhost:4873/ yarn config set registry http://localhost:4873/ bun config set registry http://localhost:4873/ npm view @types/node # has recent updates npm view pgmock # has <5,000 weekly downloads Downside: npm-daycare won't show packages that are younger than 48h on its default config, so be aware of that when you try to update your packages to patch a zero-day exploit. You probably also shouldn't rely on this as your only line of defense. Curious to hear what you think! [1] https://news.ycombinator.com/item?id=45260741
Does the same job
all alternatives →- SNSafe-NPM – only install packages that are +90 days oldNov 2025 · github.com · ▲90
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
- VOVerdaccio – Open-Source Lightweight private NPM proxy registry2018 · verdaccio.org · ▲47
- IVI've been making JavaScript sandbox alone for 6 years2022 · playcode.io · ▲397
Hi HN! Thanks for your attention to my post. It was a big challenge to run most of Node.js packages in browser, fast moreover. Virtual File system, resolve import/export. I got cold many times, depressions, burned out, yet still alive and finished it. Many guys helped me with an advice. Many users give a lot of positive feedback. There are 200,000 monthly unique users. I work full time now because of the freemium business model. To be honest - I am happy after many years of hard work.
- DODepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configsJun 2026 · github.com · ▲40
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
More dev tools this month
the category →
The first open-source price index for GPU compute
Dev tools · 10d ago · getcomputable.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 2d ago · opentrailpaper.com
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
Launched alongside, September 2025
the whole month →
- AS
Commerce · Sep 2025 · anycrap.shop
- TE
I made a built-from scratch Wayland Compositor to display any GUI app* in the terminal! I think there is a lot of unexplored potential in custom Wayland compositors, a lot of really cool things you can embed existing applications into! So, I started with embedding apps into the terminal because that is the easiest input/output (output is just utf-8 and I use the great `chafa` library for that, and I just read from stdin for the input). If you have any other ideas for cool Wayland compositors, let me know. I purposedly wrote 80% the app in Typescript to appeal to the most developers and…
Dev tools · Sep 2025 · github.com
- IR
Years ago I stumbled across a basic version of this concept and it stuck with me. I knew if I was ever going to take on such a project, it would need to be flawless, but without coding experience it was just another idea that would never happen. By the end of 2024, as AI coding tools exploded everywhere, I finally had a way to make it real. I started from zero knowledge and spent months collaborating with AI agents as a learning experience. Every pixel and every function went through me. The AI translated what I asked for into code, but every decision was human. I didn't use existing OS…
AI · Sep 2025 · mitchivin.com
