OUR OWN PRODUCT · OPEN SOURCE
SAFEINSTALL:POLICY BEFORE THE PACKAGE INSTALLS.
SafeInstall is our open-source CLI (MIT license) that wraps npm, pnpm and bun with a pre-install policy – for developers and AI coding agents like Claude Code, Codex and Cursor.
PACKAGE INSTALLS ARE AN ATTACK SURFACE
Supply-chain attacks via npm and comparable registries are on the rise. How software gets built has changed – how installs get secured hasn't.
Lifecycle scripts (preinstall, install, postinstall) run arbitrary code during installation – before your own application even starts.
AI coding agents suggest packages in seconds – with no check of release date, scripts, or source.
Scanners like npm audit only report known vulnerabilities after installation, not before.
A valid signature alone doesn't protect you: a compromised maintainer account can publish a malicious version that still verifies cryptographically.
OUR OWN PRODUCT
EIGHT CHECKS.
FOUR BY DEFAULT, FOUR OPT-IN.
SafeInstall evaluates the policy locally before npm, pnpm or bun ever run – not a CVE scanner, but a gate before installation.
ACTIVE BY DEFAULT
- Blocks registry releases younger than 72 hours (default, configurable).
- Blocks packages with preinstall, install or postinstall scripts unless explicitly allowed.
- Blocks non-registry sources (Git, tarball, URL) unless explicitly allowed.
- Detects trust downgrades – for example when a dependency changes source or suddenly introduces scripts.
OPT-IN
- Typo-squatting detection using Damerau-Levenshtein distance against known package names.
- Sigstore provenance verification with a pinnable trusted publisher (expected source repository).
- Checks transitive dependencies directly from the lockfile, with no extra registry calls.
- Provenance continuity check detects deviations from a package's established provenance baseline.
HOW IT'S BUILT
A Node CLI tool that runs locally, evaluates public registry and Sigstore metadata, and hooks into Claude Code, Codex and Cursor.
Node CLI
Node 20 or later, wraps npm, pnpm and bun as a prefixed command.
Sigstore
Verifies provenance attestations against the public Sigstore trust root.
Shell hooks
Hooks into Claude Code, Codex and Cursor at the shell level – regardless of whether the agent cooperates.
MCP server
Lets agents consult the policy in advance (check_package), before an install is even suggested.
Open source, MIT licensed, available as an npm package – npx safeinstall-cli init sets up configuration and guard hooks in one step.
WHAT THIS MEANS FOR YOUR PROJECT
We also build security tooling, not just websites. SafeInstall shows that we have deep technical expertise in supply-chain security, Sigstore and AI agent workflows.
Open source as proof, not just a claim. The source code is public and the license is MIT – anyone can verify how we work.
One point of contact. For your project, that means we bring the same technical depth to your systems.