Hi Product Hunt! 👋 I built DepSentinel after a routine `npm install` pulled in over a thousand packages I had never read. Most of them transitive, some with install scripts, none reviewed. Supply-chain attacks (event-stream, ua-parser-js, colors.js…) keep happening and `npm audit` runs after the damage is already installed. DepSentinel scans your lockfiles before anything runs: malicious packages, typosquats, suspicious install scripts, known CVEs, unpinned GitHub Actions and unpinned Docker images. It runs fully on your machine, no account, no telemetry, no server of ours. The feature I'm most proud of is `depsentinel guard npm install`: it generates the lockfile with --ignore-scripts (so no install script runs), scans it, and only then runs the real install. That closes the window where a normal `npm install` already executed attacker code. It's free, MIT-licensed and works in CI with a single `--ci --fail-on high`. Would love your feedback, especially false positives — there's a template for that. Thanks for checking it out! 🛡️

DepSentinel

Block malicious dependencies before they reach your machine

Block malicious dependencies before they reach your machine