mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
df754ccc82
* fix: parsePackageInfo to handle pkg names with special character * Enhance pmg outputs by adding colors and removing markdown notions * Update pkg/wrapper/npm_base.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com> * Update npm_base.go Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com> * test: add tests for removeMarkdown * chore: remove duplicate code * refactor: convert TerminalColors to global var and split markdown utils --------- Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
PMG (Package Manager Guard)
PMG is a security-focused wrapper for package managers that helps detect and prevent the installation of potentially malicious packages.
📑 Table of Contents
Supported Ecosystems
Currently, PMG supports the following package ecosystems:
| Ecosystem | Status | Command |
|---|---|---|
| NPM | ✅ Active | pmg npm install <package> |
| PyPI | 🚧 Planned | Coming soon |
| Go | 🚧 Planned | Coming soon |
Installation
- Build from source
Ensure $(go env GOPATH)/bin is in your $PATH
go install github.com/safedep/pmg@latest
Prerequisites
- Go 1.24
- SafeDep API credentials (SAFEDEP_API_KEY and SAFEDEP_TENANT_ID)
Environment Variables
SAFEDEP_API_KEY: Your SafeDep API keySAFEDEP_TENANT_ID: Your SafeDep tenant ID
Visit https://docs.safedep.io/cloud/quickstart for instructions on obtaining your API Key and Tenant ID.
Usage
Scanning NPM packages
pmg npm install <package-name>
OR
pmg npm i <package-name>
OR
pmg npm add <package-name>
Contributing
Please feel free to submit a Pull Request.