External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Multiple Misc Updates (#23)

Browse Source 
* docs: Update README

* docs: Add badges
This commit is contained in:
Abhisek Datta
2025-05-15 21:34:41 +05:30
committed by GitHub
parent 6c7e3b875a
commit 7c9681ef00
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13
View File
@@ -1,5 +1,16 @@
# Package Manager Guard (PMG) # Package Manager Guard (PMG)
<p>
Created and maintained by <b><a href="https://safedep.io/">https://safedep.io</a></b> with contributions from the community 🚀
</p>
[![Go Report Card](https://goreportcard.com/badge/github.com/safedep/pmg)](https://goreportcard.com/report/github.com/safedep/pmg)
![License](https://img.shields.io/github/license/safedep/pmg)
![Release](https://img.shields.io/github/v/release/safedep/pmg)
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/safedep/pmg/badge)](https://api.securityscorecards.dev/projects/github.com/safedep/pmg)
[![CodeQL](https://github.com/safedep/pmg/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/safedep/pmg/actions/workflows/codeql.yml)
🤖 PMG protects developers from getting compromised by malicious packages. 🤖 PMG protects developers from getting compromised by malicious packages.
See [example](https://safedep.io/malicious-npm-package-express-cookie-parser/) See [example](https://safedep.io/malicious-npm-package-express-cookie-parser/)
@@ -154,6 +165,7 @@ Refer to [CONTRIBUTING.md](CONTRIBUTING.md)
<details> <details>
<summary>Approximate dependency version resolution</summary> <summary>Approximate dependency version resolution</summary>
`pmg` resolves the transitive dependencies of a package to be installed. It does it by querying `pmg` resolves the transitive dependencies of a package to be installed. It does it by querying
package registry APIs such as `npmjs` and `pypi`. However, almost always, dependency versions are package registry APIs such as `npmjs` and `pypi`. However, almost always, dependency versions are
specified as ranges instead of specific version. Different package managers have different ways of specified as ranges instead of specific version. Different package managers have different ways of
@@ -162,4 +174,5 @@ resolving these ranges. It also depends on peer or host dependencies already ava
`pmg` is required to block a malicious package *before* it is installed. Hence it applies its own heuristic `pmg` is required to block a malicious package *before* it is installed. Hence it applies its own heuristic
to choose a version from a version range for evaluation. This is fine when all versions of a given package to choose a version from a version range for evaluation. This is fine when all versions of a given package
is malicious. However, there is a possibility of inconsistency when a specific version of a package is malicious. is malicious. However, there is a possibility of inconsistency when a specific version of a package is malicious.
</details> </details>