Auto-Unpublish NPM Packages Published Outside CI
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
A lot of vendors and open-source projects shared guidance on protecting users from downloading malicious NPM packages after the Shai-Hulud campaign — but almost nothing focused on protecting maintainers from accidentally (or maliciously) publishing them.So we built a small tool that continuously monitors your NPM packages and automatically unpublishes any version not produced by your CI workflow.
HN · launched Nov 27, 2025 · 6 upvotes (top 73%) · 0 views
Niche: developer utility tools · 561 launches, 8 in the last 7 days ▼ -73% · Explore this niche →
Category and tags
- Horizontal
- Dev tools
- Developer
- Not AI
- Hobby / open-source project
Visit website ↗ Source listing ↗
More like this: all 561 launches in developer utility tools →
Could you build this?
Yes This is a straightforward security utility that polls the NPM registry or listens to webhooks, compares publish metadata against GitHub Actions/CI provenance, and calls the NPM unpublish API.
Discussion
2 comments analyzed.
Concerns raised: Only reactive damage control, not preventative security, Gives false sense of security if CI already compromised, Doesn't actually lock down or protect release process, NPM token should never be visible to tools anyway
Competitors
Other products that read as similar to this one : 70 launches clear the similarity bar, closest 8 shown.
Attention rank: #66 of 71 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 4 days after the earliest competitor.
- Safe-NPM · hn · 2025-11-23 · 90 upvotes · similarity 0.49
- Safe-install · hn · 2026-05-12 · 19 upvotes · similarity 0.49
- npm Package Inspector · ph · 2026-09-21 · 2 upvotes · similarity 0.47
- iamsecure · ph · 2026-10-26 · 2 upvotes · similarity 0.42
- DepSentinel · ph · 2026-10-19 · 3 upvotes · similarity 0.41
- FixMyNPM, CLI to fix your insecure npm config · hn · 2026-05-13 · 10 upvotes · similarity 0.40
- Warden CI · ph · 2026-10-01 · 2 upvotes · similarity 0.38
- SourceMVM · github · 2026-10-12 · 14 upvotes · similarity 0.38
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.