Safe-NPM – only install packages that are +90 days old

In plain words

Safe-NPM is a command-line tool that reduces exposure to compromised npm packages by only installing versions that have been publicly available for at least 90 days. It queries the npm registry for matching package versions, filters out recently published ones, and installs the oldest qualifying version. The tool is designed for developers concerned about supply chain attacks, though it does not protect against packages that were malicious from initial release, nor does it yet control dependencies of dependencies.

written from the facts on this page · September 2026

From the sources

Safely install NPM packages. Contribute to kevinslin/safe-npm development by creating an account on GitHub.

A security-focused npm installer that protects your projects from newly compromised packages. Supply chain attacks on npm packages are a growing threat. Attackers sometimes compromise legitimate packages by: These attacks often happen suddenly—a package that was safe yesterday might be compromised today. safe-npm protects you by only installing package versions that have been publicly available for a minimum amount of time (90 days by default). This gives the security community time to discover and report malicious releases before they reach your project. For example, if you specify react@^18 and a malicious [email protected] was published yesterday, safe-npm will install the latest version…from github.com

In the maker’s words, at launch

This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug…

• 
  Safe-install – safer NPM installs with trusted build dependenciesMay 2026 · npmjs.com · ▲19

  In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…

• 
  Tips to stay safe from NPM supply chain attacks2025 · github.com · ▲96

  Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!

• 
  npm install actual-malware2022 · github.com · ▲55

  Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware

• 
  Mitigate against 0-day supply chain attacks with safe-NPM2022 · github.com · ▲5

  safe npm time travel installs. Contribute to stagas/safe-npm development by creating an account on GitHub.

• 
  DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configsJun 2026 · github.com · ▲40

  I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…

• 
  npm-riskMay 2026 · npmjs.com · ▲2

  Check npm package risk before you install

• 
  /dev/null▲490

  a social network for devs

  Dev tools · 4d ago · dev-null.sh

• 
  Run full iOS 16.5 firmware on Android Devices▲439

  Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.

  Dev tools · 19h ago · github.com

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 29d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 27d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 24d ago · openbot.run

• 
  Talanoa▲346

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 22d ago · talanoa.email

• 
  Guideflow▲1,338

  Create interactive product demos and step-by-step guides in seconds with Guideflow, the leading AI-powered demo automation tool.

  AI · Nov 2025 · guideflow.com

• 
  I built a synth for my daughter▲1,278

  Hardware and software projects by Ali Roberts

  Life & fun · Nov 2025 · bitsnpieces.dev

• 
  Welltory▲1,028

  Measure your wellness. Use data to feel great every day.

  Work · Nov 2025 · welltory.com

• 
  Gemini 3▲1,016

  Bring any idea to life with multimodal capabilities

  AI · Nov 2025 · blog.google

• 
  TrustMRR▲833

  LLM Gateway is a b2b artificial intelligence based in United States, founded in 2025. $259,539/month in verified Stripe revenue. $78,764 MRR. Ahrefs Domain Rating 52/100. growing 55% month-over-month. Track LLM Gateway's verified metrics on TrustMRR.

  Growth · Nov 2025 · trustmrr.com

• 
  Boing▲782

  Life & fun · Nov 2025 · boing.greg.technology