pmg/README.md

PMG (Package Manager Guard)

PMG is a wrapper for package managers to protect developers from installing malicious packages.

TL;DR

Set up pmg to protect you development environment:

echo "alias npm='pmg npm'" >> ~/.zshrc
echo "alias pnpm='pmg pnpm'" >> ~/.zshrc
source ~/.zshrc

Continue using your favorite package manager as usual:

npm install <package-name>
pnpm add <package-name>

📑 Table of Contents

• PMG (Package Manager Guard)
  • TL;DR
  • 📑 Table of Contents
  • Features
  • Supported Ecosystems
  • Installation
    • Binaries
    • Build from Source
  • Usage
    • PMG in Action
      • Malicious Package Detection
      • Bulk Package Analysis
  • Contributing

Features

• 🚫 Malicious package identification using SafeDep Cloud
• 🌲 Deep dependency analysis and transitive dependency resolution
• ⚡ Fast and efficient package verification
• 🔄 Seamless integration with existing package managers

Supported Ecosystems

PMG supports the following package ecosystems:

Ecosystem	Status	Command
NPM	✅ Active	pmg npm install <package>
PNPM	✅ Active	pmg pnpm add <package>
PyPI	🚧 Planned	Coming soon
Go	🚧 Planned	Coming soon

Want us to support your favorite package manager? Open an issue and let us know!

Installation

Binaries

Download the latest binary from the releases page.

Build from Source

Ensure $(go env GOPATH)/bin is in your $PATH

go install github.com/safedep/pmg@latest

Usage

Install a package with npm or pnpm:

pmg npm install <package-name>
pmg pnpm add <package-name>

Set shell alias for convenience:

alias npm="pmg npm"
alias pnpm="pmg pnpm"

PMG in Action

Malicious Package Detection

Bulk Package Analysis

Contributing

Refer to CONTRIBUTING.md