Safe-install – safer NPM installs with trusted build dependencies

In plain words

Safe-install is an npm package that adds security protections to the dependency installation process. It allows developers to disable install scripts by default and create a whitelist of trusted dependencies permitted to run build scripts, while also blocking exotic sub-dependencies. The tool is designed for developers concerned about supply chain security risks in npm installations.

written from the facts on this page · September 2026

From the sources

In the maker’s words, at launch

In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting: https://gajus.com/blog/3-pnpm-settings-to-protect-yourself-f... I was hoping npm would eventually add something like this, but it does not seem to be happening soon, so I made a small package for it.

• 
  Dograh▲592

  The open source VAPI alternative

  Dev tools · 25d ago · dograh.com

• 
  Meridian▲530

  Don't let your work go unnoticed. Get promoted!

  Dev tools · 20d ago · meridiona.com

• 
  x1▲516

  Lovable for iPhone apps go from idea to App Store

  Dev tools · 11d ago · x1.new

• 
  The GTM Co-Founder▲402

  Open-source GTM skills for technical founders

  Dev tools · 29d ago · gtmcofounder.com

• 
  Open-Source eInk Bike Computer▲392

  OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.

  Dev tools · 2d ago · opentrailpaper.com

• 
  Nuphos▲380

  The AI-Native DevOps Workspace.

  Dev tools · 24d ago · nuphos.ai

• 
  Brew ▲905

  Like Claude design for email marketing

  AI · May 2026 · brew.new

• 
  Kilo Code for VS Code▲897

  Parallel agents, diff reviewer, and multi-model comparisons

  Dev tools · May 2026 · kilo.ai

• 
  StoreClaw▲805

  Grow your store profits with agents that know how to sell

  AI · May 2026 · storeclaw.ai

• 
  PollyReach▲796

  Give your agent a real number and voice to make calls.

  AI · May 2026 · pollyreach.ai

• NW
  Needle: We Distilled Gemini Tool Calling into a 26M Model▲776

  Hey HN, Henry here from Cactus. We open-sourced Needle, a 26M parameter function-calling (tool use) model. It runs at 6000 tok/s prefill and 1200 tok/s decode on consumer devices. We were always frustrated by the little effort made towards building agentic models that run on budget phones, so we conducted investigations that led to an observation: agentic experiences are built upon tool calling, and massive models are overkill for it. Tool calling is fundamentally retrieval-and-assembly (match query to tool name, extract argument values, emit JSON), not reasoning. Cross-attention…

  Life & fun · May 2026 · github.com

• FM
  Files.md – Open-source alternative to Obsidian▲730

  Dev tools · May 2026 · github.com