PackGuard

What it does

428 npm packages already contain AI assistant dotfiles. 33 exposed live keys. PackGuard hooks into prepublishOnly, opens your tarball before it ships, and blocksclaude/,cursor/, source maps with embedded source, and high-entropy secrets. Refuses to publish until it's clean. Free for solo OSS.

428 npm packages contain AI assistant config files. 33 had live API keys. PackGuard hooks into prepublishOnly and blocks them before they ship.

A Lakera audit of 46,500 npm packages found 428 containing .claude/settings.local.json . 33 had live API keys. PackGuard intercepts the tarball before it ships. $ npx packguard scan ──────────────────────────────────────────────────────── FILE STATUS REASON ──────────────────────────────────────────────────────── .claude/settings.local.json BLOCKED ai_artifact:.claude .cursor/mcp.json BLOCKED ai_artifact:.cursor dist/index.js.map WARNING source_map_with_sources dist/index.js CLEAN README.md CLEAN ──────────────────────────────────────────────────────── ✗ Publish blocked. Fix the issues above. 428 npm packages with AI config files 33 of those had live credentials 512K lines leaked by…from packguard.kartikshukla.dev

• 
  RefuseJun 2026 · refuse.dev · ▲84

  Block vulnerable package installs for you and your AI

• 
  CtrlAIMar 2026 · github.com · ▲104

  Transparent proxy that secures AI agents with guardrails

• 
  Packmind Open SourceNov 2025 · packmind.com · ▲111

  Roll out coding standards safely across repos and agents

• 
  LaunchGuardianJul 2026 · ▲5

  Know if your AI-built app is actually production-ready

• 
  SkillGuardAug 2026 · github.com · ▲2

  Scans AI agent skills for malicious code

• 
  Auto-Unpublish NPM Packages Published Outside CINov 2025 · github.com · ▲6

  A lot of vendors and open-source projects shared guidance on protecting users from downloading malicious NPM packages after the Shai-Hulud campaign — but almost nothing focused on protecting maintainers from accidentally (or maliciously) publishing them. So we built a small tool that continuously monitors your NPM packages and automatically unpublishes any version not produced by your CI workflow.

• 
  Spira Maxima▲578

  Video model that turns script into viral social media videos

  AI · 18d ago · spira.ai

• 
  Rill Browser▲540

  The browser where Claude Code and Codex work beside you

  AI · 17d ago · rill.love

• 
  Germany's new sovereign AI model Kolibri▲424

  Kolibri is Aleph Alpha

  AI · 19d ago · tej.as

• 
  Giving Opus 5.5 a simulated paint canvas▲392

  Paintings by AI models: programs run through a simulation of oil paint.

  AI · 21d ago · stillwet.art

• 
  PixVerse R2▲381

  A real-time world model you can explore and change

  AI · 29d ago · world.pixverse.video

• 
  Hemory▲381

  Keep listening. Searchable memory for your AI agents.

  AI · 30d ago · hemory.com

• 
  Brew ▲900

  Like Claude design for email marketing

  AI · May 2026 · brew.new

• 
  Kilo Code for VS Code▲896

  Parallel agents, diff reviewer, and multi-model comparisons

  Dev tools · May 2026 · kilo.ai

• 
  StoreClaw▲806

  Grow your store profits with agents that know how to sell

  AI · May 2026 · storeclaw.ai

• 
  PollyReach▲795

  Give your agent a real number and voice to make calls.

  AI · May 2026 · pollyreach.ai

• 
  Needle: We Distilled Gemini Tool Calling into a 26M Model▲776

  Hey HN, Henry here from Cactus. We open-sourced Needle, a 26M parameter function-calling (tool use) model. It runs at 6000 tok/s prefill and 1200 tok/s decode on consumer devices. We were always frustrated by the little effort made towards building agentic models that run on budget phones, so we conducted investigations that led to an observation: agentic experiences are built upon tool calling, and massive models are overkill for it. Tool calling is fundamentally retrieval-and-assembly (match query to tool name, extract argument values, emit JSON), not reasoning. Cross-attention…

  Life & fun · May 2026 · github.com

• 
  Files.md – Open-source alternative to Obsidian▲730

  🌱 Private, quiet space for thinking. Simple app for .md files. - zakirullin/files.md

  Dev tools · May 2026 · github.com