Abhisek DattaandGitHub
e86b6ef056
* feat: Add separate package manager and resolver * fix: Npm dependency resolver * feat: Add analyzer for malysis query * feat: Add package manager guard as the orchestrator * feat: Add PMG to orchestrate installation * Add concurrent scan execution * Introduce package manager interaction abstraction * feat: Add UI port for guard * Remove refactored source files * Update README * fix: CI script for multi-arch build * ci: goreleaser CI fix * fix: npm command parser to extract package names * feat: Introduce global config primitive * fix: Close results channel for clean goroutine exit * ci: Add container image releaser * test: Improve test for npm resolver * refactor: Analyzer to generalise * Improve UI with additional info * fix: Goreleaser config * fix: npm resolver bug * fix: Fail when command exec workflow fails * fix: Bug with transitive dependency resolution * fix: Synchronize common data update in dependency resolver * chore: Improve log handling * docs: Update README * fix: UI text wrapping * fix: UI handling bugs * feat: Use concurrent dependency resolver
4.4 KiB
Package Manager Guard (PMG)
🤖 PMG protects developers from getting compromised by malicious packages. See example
- Wraps your favorite package manager (eg.
npm) - Blocks malicious packages at install time
- No configuration required, just install and use
TL;DR
Set up pmg to protect you development environment from malicious packages:
echo "alias npm='pmg npm'" >> ~/.zshrc
echo "alias pnpm='pmg pnpm'" >> ~/.zshrc
source ~/.zshrc
Continue using your favorite package manager as usual:
npm install <package-name>
pnpm add <package-name>
📑 Table of Contents
Features
- 🚫 Malicious package identification using SafeDep Cloud
- 🌲 Deep dependency analysis and transitive dependency resolution
- ⚡ Fast and efficient package verification
- 🔄 Seamless integration with existing package managers
Supported Package Managers
PMG supports the following package managers:
| Package Manager | Status | Command |
|---|---|---|
npm |
✅ Active | pmg npm install <package> |
pnpm |
✅ Active | pmg pnpm add <package> |
yarn |
🚧 Planned | |
pip |
🚧 Planned | |
poetry |
🚧 Planned | |
uv |
🚧 Planned |
Want us to support your favorite package manager? Open an issue and let us know!
Installation
Binaries
Download the latest binary from the releases page.
Build from Source
Ensure $(go env GOPATH)/bin is in your $PATH
go install github.com/safedep/pmg@latest
Usage
Install a package with npm or pnpm:
pmg npm install <package-name>
pmg pnpm add <package-name>
Set shell alias for convenience:
alias npm="pmg npm"
alias pnpm="pmg pnpm"
Continue using your favorite package manager as usual:
npm install <package-name>
pnpm add <package-name>
Silent Mode
Use the --silent flag to run PMG in silent mode:
pmg --silent npm install <package-name>
Verbose Mode
Use the --verbose flag to run PMG in verbose mode:
pmg --verbose npm install <package-name>
Debugging
Use the --debug flag to enable debug mode:
pmg --debug npm install <package-name>
Store the debug logs in a file:
pmg --debug --log /tmp/debug.json npm install <package-name>
PMG in Action
Malicious Package Detection
Bulk Package Analysis
Contributing
Refer to CONTRIBUTING.md
Limitations
Approximate dependency version resolution
`pmg` resolves the transitive dependencies of a package to be installed. It does it by querying package registry APIs such as `npmjs` and `pypi`. However, almost always, dependency versions are specified as ranges instead of specific version. Different package managers have different ways of resolving these ranges. It also depends on peer or host dependencies already available in the application.pmg is required to block a malicious package before it is installed. Hence it applies its own heuristic
to choose a version from a version range for evaluation. This is fine when all versions of a given package
is malicious. However, there is a possibility of inconsistency when a specific version of a package is malicious.