Hi HN

I am the founder of SafeDep. We have been detecting malicious packages for a while. Coming from DevSecOps background, I always considered malicious package detection & protection to be a build stage problem. But I was wrong since the S1ngularity and early Shai-Hulud days.

In 2026, we pretty much started worrying more about our own dev machines than CI/CD environment. Depending only on threat intelligence data (OSV / SafeDep / Socket / any other source) to protect our own dev machines did not feel right. We wanted to build a multi-layered protection that can get 100% visibility of OSS packages coming in, and can protect against known and “hopefully” unknown threats. That’s how Package Manager Guard (PMG) started. Core idea was simple:

- Start a local proxy (localhost)

- Make sure supported package managers like npm, pnpm, pip etc. goes through it

- Use threat intelligence data to fail fast on known malicious packages

- Apply policies like dependency cooldown as additional guardrails

- Adopt a policy language like CEL to support custom policies (roadmap)

- Everything stays local with stackable policies and audit log

- Threat model - Protect “willing” developers against malicious open source packages

Note: PMG does not consider a malicious developer as part of its threat model. So no real effort has been put to “enforce”, rather the goal is reduced friction while being effective.

Then came across Anthropic’s SRT and suddenly realized that in-process OS-native sandboxing is a good solution for limiting blast radius against unknown threats, especially since package managers have predictable runtime behaviour that can be allowed via. a sandbox while denying larger user permissions. Adopted seatbealt on MacOS and Landlock + Seccomp BPF for Linux. Seccomp BPF with Go was a battle of its own due to lack of control on OS threads, but finally managed to get it working without major performance cost.

To summarize, PMG does not only depend’s on SafeDep’s ability to find malicious packages. It enforces dependency cooldown (useful if you are stuck with older npm/pnpm), sandbox to protect against malicious packages. Our near term goal is to support CEL as a policy language and improve tooling around sandbox rules to make adoption easier.

Any feedback is welcome.

Show HN: Codex Micro on Your Phone

Uhubctl – control USB power per-port on smart USB hubs

Don't Put an LLM Behind an MCP Server

I built a page that tells you what AI model your laptop can run

Show HN: Exceltool.io – 120 free Excel tools, 100% private in the browser

Debating the role of large language models in the kernel community

Sports solved a problem that nearly killed television

Show HN: Turning a Dumb AC Unit Smart (Without Losing My Security Deposit)

Show HN: Hexagonal Game of Life Explorer

Meta's AI Models Are Powering the First Wave of Genesis Mission Projects

A private enterprise AI gateway

Cloudflare R2 is now Generally Available (2022)

The Download: Chinese AI divides the White House, and a record copyright payout

Show HN: QuantmLayer – kernel-enforced containment for AI coding agents

Devin Outposts: Run Devin sessions on your own infra

Canada's promises to capture carbon span almost 20 years, with little gains

Iran's IRGC claims attack on Amazon's main data hub in Bahrain

Yubikey 5.8: Verified Authorization for the New Era of Identity and AI

Text as Music

Show HN: PMG, open source package firewall

Show HN: OSS Cross-Harness self hosted registry and analytics for AI Agents

Show HN: Polymm – the Polymarket market-making bot behind my $5k wallet

Stop funding data governance, run it with agents instead

Regular Expressions for Hcpcs Codes

Locally everywhere does not imply everywhere

Martin Picard's Mitochondrial Theory of Mind

FBI Forced to Reveal New Details on How It Redacted Epstein Files

What Modern NVMe Storage Can Do, and How to Exploit It [pdf]

Android 17 desktop also runs the Linux desktop

On Building Daily Puzzles, On Ending Them, and Other Thoughts

Ask HN: Are LLMs replacing open-source ecosystems for personal project codes?