Show HN: Computer Police – block malicious NPM/pip installs locally

https://computer.police.dev/

1•kannthu•42m ago

A couple of months ago, our team got hit by the first version of Shai-Hulud through a random `npm install`. We didn't catch it until it was too late.

I built Computer Police for our team to never be in this situation again.

It's designed to block that earlier. It runs a local registry proxy between your package manager and npm/PyPI, and stops confirmed-malicious packages before they touch disk.

It's deliberately narrow: malware only, no CVE scanning, no heuristics, no telemetry, no root, and removable with one command. Works locally, in CI, and in agent sandboxes.

https://computer.police.dev/

Comments

hootz•35m ago

Interesting. How long does it usually take for an attack to be identified and catalogued at OSV? Should this be used together with minimum release date?

kannthu•22m ago

I don't have the exact number for you, but what I observed was that it took a couple of hours for npm to remove some of the packages this week, even though an advisory was published

+ To be clear, this tool does not solve the problem if you are one of the first people to get infected; it minimizes your chance if you are the N-th person

Codex for Everything Exfiltrates Connected Data

Inside SpaceX's IPO Plan

The fastest growing political party is Cockroach Janata Party [video]

Leetcode.nvim

Agents Sometimes Catastrophize

EPA Official Agrees to Review Data Center Water Impact (AOC Shows Dirty Water)

DashAttention: Differentiable and Adaptable Sparse Hierarchical Attention

Test-Driving the Lance Lakehouse Format in DuckDB

S3-Compatible object storage at $15/TB with free egress and CDN

Temporal is becoming Crystal Palace Football Club's front-of-shirt partner

SpaceX is heavily reliant on Starlink for growth and profit for IPO

SpaceX IPO reads like Hollywood fantasy version of the future

Apple to broadcast MLS game shot entirely on 15 iPhones

White House postpones AI executive order signing ceremony

Ask HN: Failing interviews for mid-level SWE in UK, advice please

I created an extension for Claude that shares context on how you work

A multi-agent system for automating scientific discovery

Chewing gum restores dad's taste and smell years after Covid

Show HN: From one Claude agent to a fleet – in five small steps

Sony Flamingo - The Coolest Record Player Ever Made

A permissively licensed Vita FPGA Architecture in only 380 lines of Verilog

Nature's Hardware Store: building the future with biology [video]

Inside the next phase of OpenAI's political strategy

Trump Postpones AI Executive Order Due to Concerns About Overregulation

Japanese Verb Conjugation the Simple Hard Way

Show HN: Canonry tracks how AI cites you – agent-first, open source

Show HN: Online Sound Test

IRS requires identity verification with a private company for refunds?

Pivoting Out of Healthcare

AMD Ryzen AI Halo for AI Developers