Safe-install
safer NPM installs with trusted build dependencies
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
In light of the ongoing npm supply chain compromises, I built safe-install:https://www.npmjs.com/package/@gkiely/safe-installIt brings a couple of protections I wanted from npm but are not built in.Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts:https://bun.com/docs/guides/install/trustedIt also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:https://gajus.com/blog/3-pnpm-settings-to-protect-yourself-f...I was hoping npm would eventually add something like this, but it does not seem to be happening soon, so I made a small package for it.
HN · launched May 12, 2026 · 19 upvotes (top 27%) · 0 views
Niche: software package managers · 51 launches, 2 in the last 7 days ▼ -78% · Explore this niche →
Category and tags
- Horizontal
- Dev tools
- Developer
- Not AI
- Hobby / open-source project
Visit website ↗ Source listing ↗
More like this: all 51 launches in software package managers →
Could you build this?
Yes A CLI wrapper around `npm install` that filters and prompts for install scripts based on a whitelist can be written in a few hundred lines of Node.js.
Discussion
5 comments analyzed.
Competitors mentioned: pnpm, volta, Nexus, Artifactory, artifact-keeper
Concerns raised: npm is default, people use it out of habit, still need trusted dependency builds beyond script disabling, only valuable for single devs, not security-minded organizations
Feature requests: npm should enable ignore-scripts by default
Competitors
Other products that read as similar to this one : 159 launches clear the similarity bar, closest 8 shown.
Attention rank: #51 of 160 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 170 days after the earliest competitor.
- Safe-NPM · hn · 2025-11-23 · 90 upvotes · similarity 0.63
- DepsGuard · hn · 2026-06-01 · 40 upvotes · similarity 0.53
- DepSentinel · ph · 2026-10-19 · 3 upvotes · similarity 0.50
- CompatLab · ph · 2026-10-09 · 1 upvotes · similarity 0.49
- Auto-Unpublish NPM Packages Published Outside CI · hn · 2025-11-27 · 6 upvotes · similarity 0.49
- npm Package Inspector · ph · 2026-09-21 · 2 upvotes · similarity 0.47
- iamsecure · ph · 2026-10-26 · 2 upvotes · similarity 0.46
- CapLock · ph · 2026-09-28 · 1 upvotes · similarity 0.44
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.