Safe-install
safer NPM installs with trusted build dependencies
Details
- External ID
- 48102636
- Source
- HN
- Company
- —
- Product
- Safe-install
- Website domain
- npmjs.com
- Launched
- May 12, 2026
- Cohort
- —
- Upvotes
- 19
- Upvotes percentile
- 0.7326332794830371
- Tags
- —
- Fetched at
- Sept. 7, 2026, 9:26 p.m.
- Updated at
- Sept. 7, 2026, 9:26 p.m.
Description
In light of the ongoing npm supply chain compromises, I built safe-install:https://www.npmjs.com/package/@gkiely/safe-installIt brings a couple of protections I wanted from npm but are not built in.Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts:https://bun.com/docs/guides/install/trustedIt also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:https://gajus.com/blog/3-pnpm-settings-to-protect-yourself-f...I was hoping npm would eventually add something like this, but it does not seem to be happening soon, so I made a small package for it.
Enrichment
- Theme
- self-hosted infrastructure and security tools
- Vertical
- —
- Function
- —
- Audience
- Developer
- AI stance
- Not AI
- Project type
- Hobby / open-source project
- Normalized one-liner
- secure npm dependency installation
- Manually corrected
- False
Could you build this?
Yes A CLI wrapper around `npm install` that filters and prompts for install scripts based on a whitelist can be written in a few hundred lines of Node.js.
Discussion
5 comments analyzed.
Competitors mentioned: pnpm, volta, Nexus, Artifactory, artifact-keeper
Concerns raised: npm is default, people use it out of habit, still need trusted dependency builds beyond script disabling, only valuable for single devs, not security-minded organizations
Feature requests: npm should enable ignore-scripts by default
Competitors
Other products that read as similar to this one — 62 launches clear the similarity bar, closest 8 shown.
Attention rank: #21 of 63 (itself plus its competitors, highest first — normalized so YC and Product Hunt are compared fairly).
Launched 170 days after the earliest competitor.
- Safe-NPM · hn · 2025-11-23 · 90 upvotes · similarity 0.63
- DepsGuard · hn · 2026-06-01 · 40 upvotes · similarity 0.53
- Auto-Unpublish NPM Packages Published Outside CI · hn · 2025-11-27 · 6 upvotes · similarity 0.48
- npm Package Inspector · ph · 2026-09-21 · 2 upvotes · similarity 0.47
- CapLock · ph · 2026-09-28 · 1 upvotes · similarity 0.43
- VaultScript · ph · 2026-09-19 · 1 upvotes · similarity 0.41
- CLI that helps AI agents avoid vulnerable dependencies · hn · 2026-07-01 · 26 upvotes · similarity 0.41
- FixMyNPM, CLI to fix your insecure npm config · hn · 2026-05-13 · 10 upvotes · similarity 0.40
Other launches for this product
- No other launches for this product.