pmg/README.md

PMG (Package Manager Guard)

PMG is a wrapper for package managers to protect developers from installing malicious packages.

TL;DR

Set up pmg to protect you development environment:

echo "alias npm='pmg npm'" >> ~/.zshrc
echo "alias pnpm='pmg pnpm'" >> ~/.zshrc
source ~/.zshrc

Continue using your favorite package manager as usual:

npm install <package-name>
pnpm add <package-name>

📑 Table of Contents

• PMG (Package Manager Guard)
  • TL;DR
  • 📑 Table of Contents
  • Features
  • Supported Ecosystems
  • Installation
    • Binaries
    • Build from Source
  • Usage
    • Debugging
    • PMG in Action
      • Malicious Package Detection
      • Bulk Package Analysis
  • Contributing

Features

• 🚫 Malicious package identification using SafeDep Cloud
• 🌲 Deep dependency analysis and transitive dependency resolution
• ⚡ Fast and efficient package verification
• 🔄 Seamless integration with existing package managers

Supported Ecosystems

PMG supports the following package ecosystems:

Ecosystem	Status	Command
NPM	✅ Active	pmg npm install <package>
PNPM	✅ Active	pmg pnpm add <package>
PyPI	🚧 Planned
Go	🚧 Planned

Want us to support your favorite package manager? Open an issue and let us know!

Installation

Binaries

Download the latest binary from the releases page.

Build from Source

Ensure $(go env GOPATH)/bin is in your $PATH

go install github.com/safedep/pmg@latest

Usage

Install a package with npm or pnpm:

pmg npm install <package-name>
pmg pnpm add <package-name>

Set shell alias for convenience:

alias npm="pmg npm"
alias pnpm="pmg pnpm"

Continue using your favorite package manager as usual:

npm install <package-name>

pnpm add <package-name>

Debugging

Use the --debug flag to enable debug mode:

pmg --debug npm install <package-name>

PMG in Action

Malicious Package Detection

Bulk Package Analysis

Contributing

Refer to CONTRIBUTING.md