PMG (Package Manager Guard)

PMG is a security-focused wrapper for package managers that helps detect and prevent the installation of potentially malicious packages.

📑 Table of Contents

• Features
• Supported Ecosystems
• Installation
• Prerequisites
• Configuration
• Usage
  • NPM Packages
  • PNPM Packages
  • Common Flags
• Contributing

Features

• 🚫 Malware detection and prevention
• 🌲 Deep dependency analysis
• ⚡ Fast and efficient package verification
• 🔄 Seamless integration with existing package managers

Supported Ecosystems

Currently, PMG supports the following package ecosystems:

Ecosystem	Status	Command
NPM	✅ Active	pmg npm install <package>
PNPM	✅ Active	pmg pnpm add <package>
PyPI	🚧 Planned	Coming soon
Go	🚧 Planned	Coming soon

Installation

• Build from source

Ensure $(go env GOPATH)/bin is in your $PATH

go install github.com/safedep/pmg@latest

Prerequisites

• Go 1.24
• SafeDep API credentials (SAFEDEP_API_KEY and SAFEDEP_TENANT_ID)

Configuration

Environment Variables

Variable	Description	Required
SAFEDEP_API_KEY	Your SafeDep API key	Yes
SAFEDEP_TENANT_ID	Your SafeDep tenant ID	Yes

Get your API credentials by visiting SafeDep Quickstart Guide.

Usage

Security in Action

Malicious Package Detection

Bulk Package Analysis

NPM Packages

Install a package:

pmg npm install <package-name>

Alternative commands:

pmg npm i <package-name>     # Short form
pmg npm add <package-name>   # Alternative syntax

PNPM Packages

Install a package:

pmg pnpm add <package-name>

Common Flags

All standard package manager flags are supported:

pmg npm install --save-dev <package-name>    # Install as dev dependency
pmg pnpm add -D <package-name>               # Install as dev dependency

Contributing

Refer to CONTRIBUTING.md