Show HN: DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configs
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that checks what you have set and fixes it for you. I looked for an existing one first and couldn't find it. It started as a small weekend project and turned into a small research project on the nuances of cooldowns across package managers. Not a proof of P vs NP, but a small convenience that can save you and your loved ones from the next supply chain attack. I've raised this in a couple of HN threads since ( https://news.ycombinator.com/item?id=47878158 and https://news.ycombinator.com/item?id=48156360 ) but never actually did a Show HN for the tool itself. If you know how to edit your ~/.npmrc, which settings apply to npm vs pnpm, and which one wants minutes vs days vs seconds, you probably don't need this. But if you vibe code and just want a one click fix (or you have a PhD in CS from Stanford, ex-FAANG, started 3 YC companies, now work at Anthropic, and still just want a one click fix), read on. DepsGuard is a single Rust binary, no runtime deps, MIT. Run depsguard and it scans your user-level and repo-level configs, shows a table of what is and isn't set, you pick what to change, hit d for the diff, and apply. It writes a timestamped backup first and depsguard restore rolls it back. depsguard scan is read-only if you just want the report. The settings are the simple ones that work: min-release-age / minimumReleaseAge (npm, pnpm, yarn, bun, and uv all name it differently and use days vs minutes vs
本文内容来源于互联网，版权归原作者所有
查看原文