Safe-install – safer NPM installs with trusted build dependencies

In plain words

Safe-install is an npm package that adds security protections to the dependency installation process. It allows developers to disable install scripts by default and create a whitelist of trusted dependencies permitted to run build scripts, while also blocking exotic sub-dependencies. The tool is designed for developers concerned about supply chain security risks in npm installations.

written from the facts on this page · September 2026

From the sources

In the maker’s words, at launch

In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and…

• 
  Safe-NPM – only install packages that are +90 days oldNov 2025 · github.com · ▲90

  This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…

• 
  Tips to stay safe from NPM supply chain attacks2025 · github.com · ▲96

  Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!

• 
  npm install actual-malware2022 · github.com · ▲55

  Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware

• AI
  Auto install npm dependencies as you code2016 · npmjs.com · ▲60
• 
  DepsGuardMay 2026 · depsguard.com · ▲10

  Configure once, prevent the next compromised package install

• 
  Veln — every package, verifiedMay 2026 · veln.sh · ▲17

  Block bad npm and pip packages. Before they download.

Questions this answers

• safedevtools

• 
  Run full iOS 16.5 firmware on Android Devices▲516

  Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.

  Dev tools · 2d ago · github.com

• 
  /dev/null▲492

  a social network for devs

  Dev tools · 5d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 29d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 27d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 25d ago · openbot.run

• 
  Talanoa▲346

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 22d ago · talanoa.email

• 
  Brew ▲900

  Like Claude design for email marketing

  AI · May 2026 · brew.new

• 
  Kilo Code for VS Code▲896

  Parallel agents, diff reviewer, and multi-model comparisons

  Dev tools · May 2026 · kilo.ai

• 
  StoreClaw▲806

  Grow your store profits with agents that know how to sell

  AI · May 2026 · storeclaw.ai

• 
  PollyReach▲795

  Give your agent a real number and voice to make calls.

  AI · May 2026 · pollyreach.ai

• 
  Needle: We Distilled Gemini Tool Calling into a 26M Model▲776

  Hey HN, Henry here from Cactus. We open-sourced Needle, a 26M parameter function-calling (tool use) model. It runs at 6000 tok/s prefill and 1200 tok/s decode on consumer devices. We were always frustrated by the little effort made towards building agentic models that run on budget phones, so we conducted investigations that led to an observation: agentic experiences are built upon tool calling, and massive models are overkill for it. Tool calling is fundamentally retrieval-and-assembly (match query to tool name, extract argument values, emit JSON), not reasoning. Cross-attention…

  Life & fun · May 2026 · github.com

• 
  Files.md – Open-source alternative to Obsidian▲730

  🌱 Private, quiet space for thinking. Simple app for .md files. - zakirullin/files.md

  Dev tools · May 2026 · github.com