Identity
Typosquats & homoglyph attacks
Distance-1 typos and visually-confusable Unicode against a curated list of high-traffic packages, with an allowlist for the legitimate distance-1 names that would otherwise create noisy false positives.
Supply-chain policy gate for npm, pnpm, yarn, and PyPI
Install-path supply-chain control
Stop risky packages across npm, pnpm, yarn, and PyPI.
InstallGuard evaluates locked dependencies before install and blocks risky supply-chain patterns: typosquats, malicious install-time code, publisher churn, too-fresh releases, and known advisories. Every verdict is recorded in installguard.lock for deterministic reruns, CI gating, and audit trails.
$ installguard scan
✓ 1,273 packages cleared
policy v1 · cache hit 99.8% · 1.84s
✗ block react-toolkit-utils@2.0.0
name-squat distance-1 from `react-toolkit` (38M dl/wk)
suspicious-script postinstall executes base64-decoded payload
✗ block @acme/auth@4.1.7
publisher-change new maintainer account, registered 6h ago
⚠ warn color-utils@1.4.2
release-age published 18h ago (24h cooling-off)
Summary 1273 allow · 1 warn · 2 block
$ echo $?
1Checks mapped to real package attacks.
InstallGuard does not guess at a fuzzy package “risk score.” It checks concrete facts about each locked package and lets policy decide whether to allow, warn, or block.
Provenance
Publisher & attestation changes
Maintainer churn, brand-new publisher accounts, and missing or mismatched attestations across npm —provenance bundles and PyPI PEP 740 Trusted Publisher releases.
Execution
Install-time code execution
Deny-by-default policy on preinstall, install, postinstall, PyPI setup.py, and in-tree backend-path build backends, with a curated allowlist for native-binary packages and pattern-based detection of obfuscated payloads across both shell and Python.
Release trust
Cooling-off windows for new releases
Configurable minimum release age (default: 24h). Flags new bin entries or scripts vs. the previous release of the same package.
Distribution
Dist-tag rollback patterns
Detects suspicious latest tag regressions across major versions — a common signal of compromised maintainer activity or rollback attacks.
Disclosed
Known advisories & repo health
OSV / GHSA matching with severity gating, plus deprecation notices, archived upstream repos, and licence-allowlist violations from external package-health signals.
Stops installs, not just reports.
Most tooling tells you after a lockfile changed. InstallGuard reads the lockfile first and exits before the package manager downloads or runs install-time code. That gives mixed-package-manager teams one policy layer across npm install, pnpm install, yarn install, and uv sync.
~2s
Fast enough for every PR
Warm-cache scan of a 1,000-package lockfile in under two seconds. Small enough to run on dependency bumps, branch protection checks, and local preflight installs without becoming “that slow security step.”
0
Read-only by design
Reads package-lock.json, pnpm-lock.yaml, yarn.lock, uv.lock, poetry.lock, and pinned requirements.txt directly. Never installs and never executes lifecycle scripts. Network calls (registry metadata, OSV, deps.dev, Scorecard, PyPI Integrity API) are opt-out per provider, and —frozen runs entirely from installguard.lock — zero sockets.
100%
Every verdict explains itself
Every verdict is recorded in installguard.lock with the exact signals that produced it. Deterministic reruns, JSON and JUnit output, and GitHub PR summaries make it usable in real review and audit workflows, not just local demos.
Protect a repo in 30 seconds.
Single static binary. No daemon, no service, and no package-manager migration required.
# 1. Install
brew install jt-systems/installguard/installguard
# 2. Scan any supported lockfile
cd ~/work/your-project
installguard scan
# 3. Fail CI when policy blocks a dependency
installguard ci --summary-file summary.json