Safe-NPM
only install packages that are +90 days old
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older).Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodashHow it works: - Queries npm registry for all versions matching your semver range - Filters out anything published in the last 90 days - Installs the newest "aged" versionLimitations: - Won't protect against packages malicious from day one - Doesn't control transitive dependencies (yet - looking into overrides) - Delays access to legitimate new featuresThis is meant as a 80/20 measure against recently compromised NPM packages and is not a silver bullet. Please give it a try and let me know if you have feedback.
HN · launched Nov 23, 2025 · 90 upvotes (top 10%) · 0 views
Niche: software package managers · 51 launches, 1 in the last 7 days ▼ -89% · Explore this niche →
Category and tags
- Horizontal
- Dev tools
- Developer
- Not AI
- Hobby / open-source project
Visit website ↗ Source listing ↗
More like this: all 51 launches in software package managers →
Could you build this?
Yes It is a straightforward CLI tool that wraps npm install or checks package release dates against the npm registry API before installing.
Discussion
20 comments analyzed.
Competitors mentioned: pnpm, yarn, Debian package manager, Renovate
Concerns raised: NPM ecosystem has too many packages to safely maintain, Recent security issues decrease trust in npm, npm install can upgrade versions unexpectedly despite lockfiles, Malicious packages exploit effectiveness unclear, Minimal age gate becomes less useful if widely adopted
Feature requests: npm should be stable mainline with advantages of pnpm/yarn, TypeScript website should mention Debian package availability, Use exact version pinning instead of semver ranges by default
Competitors
Other products that read as similar to this one : 146 launches clear the similarity bar, closest 8 shown.
Attention rank: #19 of 147 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 18 days after the earliest competitor.
- Safe-install · hn · 2026-05-12 · 19 upvotes · similarity 0.63
- Auto-Unpublish NPM Packages Published Outside CI · hn · 2025-11-27 · 6 upvotes · similarity 0.49
- DepsGuard · hn · 2026-06-01 · 40 upvotes · similarity 0.48
- npm Package Inspector · ph · 2026-09-21 · 2 upvotes · similarity 0.47
- FixMyNPM, CLI to fix your insecure npm config · hn · 2026-05-13 · 10 upvotes · similarity 0.46
- CompatLab · ph · 2026-10-09 · 1 upvotes · similarity 0.46
- iamsecure · ph · 2026-10-26 · 2 upvotes · similarity 0.45
- CVE-2026-126187-poc · github · 2026-11-08 · 32 upvotes · similarity 0.45
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.