
pkg.vc
Install npm packages from pull requests or branches
What it does
Preview and test npm packages from pull requests instantly. Install directly from PRs, keep experiments off npmjs.org, and get faster feedback loops. Built for dev teams who need secure, reliable package testing.
Does a similar job
all alternatives →
- DODepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configsJun 2026 · github.com · ▲40
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
- Veln — every package, verifiedMay 2026 · veln.sh · ▲17
Block bad npm and pip packages. Before they download.
- NInpm install actual-malware2022 · github.com · ▲55
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
- SISafe-install – safer NPM installs with trusted build dependenciesMay 2026 · npmjs.com · ▲19
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
More dev tools this month
the category →



OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 3d ago · opentrailpaper.com

Lettertrace▲375Track your AI visibility for free (using your own API keys!)
Dev tools · 26d ago · lettertrace.com
Launched alongside, May 2025
the whole month →
- C9
Life & fun · 2025 · felixrieseberg.github.io
Appwrite Sites▲990Appwrite 2.0 brings a new engine, a rebuilt Console, five database types, an S3 API, an OAuth 2.1 server, and organization-level Domains and Firewall.
Dev tools · 2025 · appwrite.io


