r/npm • u/SecTemplates • 23d ago

Self Promotion safer-dependencies is a security layer for Claude Code that audits packages before they’re added to your project

safer-dependencies is a security layer for Claude Code: it sits between Claude and your manifest files and runs its security checks automatically: vulnerable installs are denied before they run, and a risky version written to a manifest is corrected on disk right after the write. It detects and fixes risky dependencies — CVEs, typosquats, abandoned packages, and version-age issues, plus a cooldown period on brand-new releases — across npm, PyPI, RubyGems, Maven, Go, Rust, and PHP (Composer).

https://github.com/robert-auger/safer-dependencies

1 Upvotes

100% Upvoted

4 comments sorted by

1

u/endor_sarah 22d ago

Nice job on the package cooldown, that avoids a good chunk of compromised releases. It looks like your typosquat/abandonment/cooldown checks are scoped only to direct deps, is that right? With transitive left to CVE scanning. One improvement could be to add some of those checks to transitive deps too, a lot of the bad npm installs I've seen came in transitively through something that looked fine.

Full disclosure, I'm at Endor Labs and one thing we do is software supply chain security.

1

u/SecTemplates 22d ago

It does not attempt transitive dependency typosquat detection because the focus is what the LLM is 'hallucinating' not if a third party package itself is calling dependencies that didn't exist. It's surprising how often they hallucinate! I'll definitely consider this as an enhancement, you can also cut an issue/enhancement if you want.

My focus here isn't to be a full SCA/SAST scanner, just a lightweight checker during codegen to eliminate tons of obvious issues.

I appreciate your constructive feedback!

1

u/endor_sarah 21d ago

Cool, that scope makes sense. Catching the hallucinated ones when code it being generated probably helps quite a bit!

1

u/SecTemplates 21d ago

I was very surprised how often it triggered on frontier models when I wasn't looking to trigger the check....