Veln — every package, verified

What it does

Over 20 trust signals score every npm and pip install — CVEs, maintainer drift, install scripts, hidden payloads. Bad packages refused befoSupply chain attacks on npm and PyPI keep landing in production — usually hours before any threat feed catches up. Veln is a local proxy that scores every install against 20+ trust signals (CVEs, maintainer changes, install scripts, hidden payloads) before a single byte hits your disk. Same commands, same lockfiles, zero workflow change.

• 
  RefuseJun 2026 · refuse.dev · ▲84

  Block vulnerable package installs for you and your AI

• SN
  Safe-NPM – only install packages that are +90 days oldNov 2025 · github.com · ▲90

  This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…

• SI
  Safe-install – safer NPM installs with trusted build dependenciesMay 2026 · npmjs.com · ▲19

  In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…

• NI
  npm install actual-malware2022 · github.com · ▲55

  Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware

• TT
  Tips to stay safe from NPM supply chain attacksSep 2025 · github.com · ▲96

  Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!

• DO
  DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configsJun 2026 · github.com · ▲40

  I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…

• 
  Dograh▲592

  The open source VAPI alternative

  Dev tools · 25d ago · dograh.com

• 
  Meridian▲530

  Don't let your work go unnoticed. Get promoted!

  Dev tools · 20d ago · meridiona.com

• 
  x1▲516

  Lovable for iPhone apps go from idea to App Store

  Dev tools · 11d ago · x1.new

• 
  Computable GPU Index (CGI)▲424

  The first open-source price index for GPU compute

  Dev tools · 10d ago · getcomputable.com

• 
  Open-Source eInk Bike Computer▲402

  OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.

  Dev tools · 2d ago · opentrailpaper.com

• 
  The GTM Co-Founder▲402

  Open-source GTM skills for technical founders

  Dev tools · 29d ago · gtmcofounder.com

• 
  Brew ▲905

  Like Claude design for email marketing

  AI · May 2026 · brew.new

• 
  Kilo Code for VS Code▲897

  Parallel agents, diff reviewer, and multi-model comparisons

  Dev tools · May 2026 · kilo.ai

• 
  StoreClaw▲805

  Grow your store profits with agents that know how to sell

  AI · May 2026 · storeclaw.ai

• 
  PollyReach▲796

  Give your agent a real number and voice to make calls.

  AI · May 2026 · pollyreach.ai

• NW
  Needle: We Distilled Gemini Tool Calling into a 26M Model▲776

  Hey HN, Henry here from Cactus. We open-sourced Needle, a 26M parameter function-calling (tool use) model. It runs at 6000 tok/s prefill and 1200 tok/s decode on consumer devices. We were always frustrated by the little effort made towards building agentic models that run on budget phones, so we conducted investigations that led to an observation: agentic experiences are built upon tool calling, and massive models are overkill for it. Tool calling is fundamentally retrieval-and-assembly (match query to tool name, extract argument values, emit JSON), not reasoning. Cross-attention…

  Life & fun · May 2026 · github.com

• FM
  Files.md – Open-source alternative to Obsidian▲730

  Dev tools · May 2026 · github.com