Sahil BansalandGitHub
b64f158654
* fix: resolve dependencies for manifest file scans * fix: resolve dependencies for manifest file scans * fix: resolve dependencies for manifest file scans - 2 * revert back to traditional for loop * fix(manifest-scan): resolve deps only for requirements.txt
Package Manager Guard (PMG)
Created and maintained by https://safedep.io with contributions from the community 🚀
🤖 PMG protects developers from getting compromised by malicious packages. See example
- Wraps your favorite package manager (eg.
npm) - Blocks malicious packages at install time
- No configuration required, just install and use
🔥 PMG in Action
📦 TL;DR
Install pmg
brew install safedep/tap/pmg
Set up pmg to protect you development environment from malicious packages:
echo "alias npm='pmg npm'" >> ~/.zshrc
echo "alias pnpm='pmg pnpm'" >> ~/.zshrc
source ~/.zshrc
Continue using your favorite package manager as usual:
npm install <package-name>
pnpm add <package-name>
📑 Table of Contents
🔥 Features
- 🚫 Malicious package identification using SafeDep Cloud
- 🌲 Deep dependency analysis and transitive dependency resolution
- ⚡ Fast and efficient package verification
- 🔄 Seamless integration with existing package managers
Supported Package Managers
PMG supports the following package managers:
| Package Manager | Status | Command |
|---|---|---|
npm |
✅ Active | pmg npm install <package> |
pnpm |
✅ Active | pmg pnpm add <package> |
pip |
✅ Active | pmg pip install <package> |
yarn |
🚧 Planned | |
poetry |
🚧 Planned | |
uv |
🚧 Planned |
Want us to support your favorite package manager? Open an issue and let us know!
Installation
Homebrew
You can install pmg using homebrew in MacOS and Linux
brew tap safedep/tap
brew install safedep/tap/pmg
Binaries
Download the latest binary from the releases page.
Build from Source
Ensure $(go env GOPATH)/bin is in your $PATH
go install github.com/safedep/pmg@latest
Usage
Install a package with npm, pnpm, or pip:
pmg npm install <package-name>
pmg pnpm add <package-name>
pmg pip install <package-name>
Set shell alias for convenience:
alias npm="pmg npm"
alias pnpm="pmg pnpm"
alias pip="pmg pip"
Continue using your favorite package manager as usual:
npm install <package-name>
pnpm add <package-name>
pip install <package-name>
Silent Mode
Use the --silent flag to run PMG in silent mode:
pmg --silent npm install <package-name>
Dry Run
Use the --dry-run flag to skip actual package installation. When enabled pmg will not execute
package manager commands. Useful for checking packages and their transitive dependencies for malware.
pmg --dry-run npm install <package-name>
Verbose Mode
Use the --verbose flag to run PMG in verbose mode:
pmg --verbose npm install <package-name>
Debugging
Use the --debug flag to enable debug mode:
pmg --debug npm install <package-name>
Store the debug logs in a file:
pmg --debug --log /tmp/debug.json npm install <package-name>
🤝 Contributing
Refer to CONTRIBUTING.md
🚫 Limitations
Approximate dependency version resolution
pmg resolves the transitive dependencies of a package to be installed. It does it by querying
package registry APIs such as npmjs and pypi. However, almost always, dependency versions are
specified as ranges instead of specific version. Different package managers have different ways of
resolving these ranges. It also depends on peer or host dependencies already available in the application.
pmg is required to block a malicious package before it is installed. Hence it applies its own heuristic
to choose a version from a version range for evaluation. This is fine when all versions of a given package
is malicious. However, there is a possibility of inconsistency when a specific version of a package is malicious.
PyPI registry scanning only
pmg only scans packages available in the PyPI registry when using pip. Packages installed from
alternative sources such as Git URLs, local file paths, or private registries are not analyzed for
malware detection. This limitation applies to direct installations and transitive dependencies sourced
from non-PyPI locations.