Hey PH 👋 Built this after I nearly shipped my own Anthropic API key inside an npm package sitting in a .claude/ state file I didn't know Claude Code had written. The Knostic audit is what made me realise this isn't just me: 428 of 46,500 scanned packages contain AI assistant config files. 33 had live credentials. The frustrating part: every existing scanner runs too late. gitleaks, trufflehog git history. Socket.dev, Snyk post-publish. Nobody intercepts at the npm-pack moment. PackGuard does. It's a one-line prepublishOnly hook that opens the about-to-ship tarball and refuses to publish if it finds anything dangerous. Free forever for solo OSS (no account needed). Try it right now: npx packguard scan Would love to hear: which registry should I tackle after npm — PyPI or crates.io?

PackGuard

Block AI config leaks before npm publish fires

Block AI config leaks before npm publish fires