Package Manager Guard (PMG)

Prevent supply chain attacks before they happen.

Why PMG?

Modern software development relies heavily on open-source packages. However, standard package managers (npm, pip, etc.) prioritize convenience over security, executing arbitrary code (like postinstall scripts) on your machine without validation. This vector is frequently exploited by attackers to steal credentials or inject backdoors.

PMG acts as a security middleware layer. It wraps your package manager to:

1. Analyze packages for malware before they are installed.
2. Sandbox the installation process to prevent system modification.
3. Audit every package installation event.

Quick Start

Get protected in seconds.

1. Install

MacOS / Linux (Homebrew)

brew install safedep/tap/pmg

NPM

npm install -g @safedep/pmg

See Installation for additional methods.

2. Setup

Configure your shell to use PMG automatically.

pmg setup install
# Restart your terminal to apply changes

3. Use

Continue using your favorite package manager tools as usual. PMG works silently in the background.

npm install express
# or
pip install requests

If a malicious package is detected, PMG blocks it immediately:

[PMG] Blocked malicious package: malicious-lib@1.0.0
[PMG] Reason: Known malware signature detected

Features

Feature	Description
Malicious Package Protection	Real-time protection against malicious packages using SafeDep.
Sandboxing	Enforces least privilege using OS native sandboxing to contain installation scripts.
Dependency Analysis	Deep scans of direct and transitive dependencies before they hit your disk.
Event Logging	Keeps a verifiable audit trail of all installed packages.
Zero Config	Works out of the box with sensible security defaults.
Cross-Shell	Seamlessly integrates with Zsh, Bash, Fish, and more.

Supported Package Managers

PMG supports the tools you already use:

Ecosystem	Tools	Status	Command Example
Node.js	npm	Yes	npm install <pkg>
	pnpm	Yes	pnpm add <pkg>
	yarn	Yes	yarn add <pkg>
	bun	Yes	bun add <pkg>
	npx	Yes	npx <pkg>
	pnpx	Yes	pnpx <pkg>
Python	pip	Yes	pip install <pkg>
	poetry	Yes	poetry add <pkg>
	uv	Yes	uv add <pkg>

Installation

Homebrew (MacOS/Linux)

brew tap safedep/tap
brew install safedep/tap/pmg

NPM (Cross-Platform)

npm install -g @safedep/pmg

Go (Build from Source)

# Ensure $(go env GOPATH)/bin is in your $PATH
go install github.com/safedep/pmg@latest

Binary Download

Download the latest binary for your platform from the Releases Page.

Trust and Security

Security is our first class requirement. PMG builds are reproducible and signed.

• Attestations: GitHub and npm attestations are used to guarantee artifact integrity.
• Verification: Users can cryptographically prove the binary matches the source code.
• See Trusting PMG for verification steps.

Usage Guide

PMG runs transparently, but you can control it when needed.

Paranoid Mode

Treat all unverified or suspicious packages as malicious.

pmg --paranoid npm install <package>

Dry Run

Simulate installation to check for malware without writing to disk.

pmg --dry-run npm install <package>

Debugging

Enable verbose logs for troubleshooting.

pmg --debug npm install <package>

Emergency Bypass

⚠️ Warning: Bypassing security checks exposes users to risk.

export PMG_INSECURE_INSTALLATION=true
npm install <package>

Advanced Documentation

• Trusted Packages Configuration
• Proxy Mode Architecture
• Sandboxing Details

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines on how to build and test PMG locally.

Telemetry

PMG collects anonymous usage data to improve project stability and reliability. To disable: export PMG_DISABLE_TELEMETRY=true.