Hi HN

I am the founder of SafeDep. We have been detecting malicious packages for a while. Coming from DevSecOps background, I always considered malicious package detection & protection to be a build stage problem. But I was wrong since the S1ngularity and early Shai-Hulud days.

In 2026, we pretty much started worrying more about our own dev machines than CI/CD environment. Depending only on threat intelligence data (OSV / SafeDep / Socket / any other source) to protect our own dev machines did not feel right. We wanted to build a multi-layered protection that can get 100% visibility of OSS packages coming in, and can protect against known and “hopefully” unknown threats. That’s how Package Manager Guard (PMG) started. Core idea was simple:

- Start a local proxy (localhost)

- Make sure supported package managers like npm, pnpm, pip etc. goes through it

- Use threat intelligence data to fail fast on known malicious packages

- Apply policies like dependency cooldown as additional guardrails

- Adopt a policy language like CEL to support custom policies (roadmap)

- Everything stays local with stackable policies and audit log

- Threat model - Protect “willing” developers against malicious open source packages

Note: PMG does not consider a malicious developer as part of its threat model. So no real effort has been put to “enforce”, rather the goal is reduced friction while being effective.

Then came across Anthropic’s SRT and suddenly realized that in-process OS-native sandboxing is a good solution for limiting blast radius against unknown threats, especially since package managers have predictable runtime behaviour that can be allowed via. a sandbox while denying larger user permissions. Adopted seatbealt on MacOS and Landlock + Seccomp BPF for Linux. Seccomp BPF with Go was a battle of its own due to lack of control on OS threads, but finally managed to get it working without major performance cost.

To summarize, PMG does not only depend’s on SafeDep’s ability to find malicious packages. It enforces dependency cooldown (useful if you are stuck with older npm/pnpm), sandbox to protect against malicious packages. Our near term goal is to support CEL as a policy language and improve tooling around sandbox rules to make adoption easier.

Any feedback is welcome.

Canada's promises to capture carbon span almost 20 years, with little gains

Iran's IRGC claims attack on Amazon's main data hub in Bahrain

Yubikey 5.8: Verified Authorization for the New Era of Identity and AI

Text as Music

Show HN: PMG, open source package firewall

Show HN: Cross-Harness self hosted registry and analytics for AI Agents

Show HN: Polymm – the Polymarket market-making bot behind my $5k wallet

Stop funding data governance, run it with agents instead

Regular Expressions for Hcpcs Codes

Locally everywhere does not imply everywhere

Martin Picard's Mitochondrial Theory of Mind

FBI Forced to Reveal New Details on How It Redacted Epstein Files

What Modern NVMe Storage Can Do, and How to Exploit It [pdf]

Android 17 desktop also runs the Linux desktop

On Building Daily Puzzles, On Ending Them, and Other Thoughts

Don't use Uber. Let your agent book a real taxi (NYC/SG)

What's Under Your Feet in New York City?

Nvidia Parakeet and MOSS vs. Apple's SpeechAnalyzer: benchmark round 2

Show HN: WorldBuild Bench repo: testing LLM world coherence with 3D games

The Semiotics of Companionship

Ask HN: What do you consider the function of AI to be in your life currently?

Securing America's Defense Supply Chains

$100 million for open source: A milestone built by the community

Apple winding down iPhone Upgrade Program: report

'Self-State Attacks' New Threat: AI Agents Poisoned via Their Memory

Bessent says U.S. could sanction China over AI model 'theft'

Zone of Ceremony (2019)

Models are worse at reviewing their own code

Show HN: Freeze the Model, Train the Harness

Takuslides: Yes its an AI app, but I worked hard on this

Show HN: A Scrabble-like word game for learning Spanish vocabulary