{"id":50886469,"url":"https://github.com/hexclave/npm-daycare","last_synced_at":"2026-06-15T17:32:09.736Z","repository":{"id":315139980,"uuid":"1058264724","full_name":"hexclave/npm-daycare","owner":"hexclave","description":null,"archived":false,"fork":false,"pushed_at":"2025-11-26T01:57:11.000Z","size":22,"stargazers_count":6,"open_issues_count":1,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-04T20:41:16.375Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hexclave.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-09-16T21:17:31.000Z","updated_at":"2025-11-26T01:57:15.000Z","dependencies_parsed_at":"2025-09-17T18:32:55.463Z","dependency_job_id":null,"html_url":"https://github.com/hexclave/npm-daycare","commit_stats":null,"previous_names":["stack-auth/npm-daycare","hexclave/npm-daycare"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/hexclave/npm-daycare","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hexclave%2Fnpm-daycare","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hexclave%2Fnpm-daycare/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hexclave%2Fnpm-daycare/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hexclave%2Fnpm-daycare/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hexclave","download_url":"https://codeload.github.com/hexclave/npm-daycare/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hexclave%2Fnpm-daycare/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34374146,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-15T02:00:07.085Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-15T17:32:09.002Z","updated_at":"2026-06-15T17:32:09.721Z","avatar_url":"https://github.com/hexclave.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# npm-daycare\n\nAn npm registry proxy that doesn't include package versions released in the last 48h or packages with fewer than 5,000 downloads.\n\n---\n\n## Quickest quick start ⚡️\n\n```bash\ndocker run --pull=always --rm --name npm-daycare -p 4873:4873 bgodil/npm-daycare\n\nnpm set registry http://localhost:4873/\npnpm config set registry http://localhost:4873/\nyarn config set registry http://localhost:4873/\nbun config set registry http://localhost:4873/\n\nnpm view @types/node  # has recent updates\nnpm view pgmock  # has \u003c5,000 weekly downloads\n```\n\nThat bootstraps the default policies immediately. Tweak `MIN_WEEKLY_DOWNLOADS` and `MIN_AGE_HOURS` if you need different X/Y thresholds.\n\n---\n\n## Why npm-daycare exists 🛡️\n\nPublic registries move fast and automated pipelines install new versions seconds after release. Attackers know this and repeatedly target JavaScript ecosystems. Some recent examples:\n\n- [Tinycolor/Crowdstrike/Shai-Hulud attack](https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages)\n- [chalk/simple-swizzle/Qix](https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack)\n- [ua-parser-js](https://www.cisa.gov/news-events/alerts/2021/10/22/malware-discovered-popular-npm-package-ua-parser-js)\n- [event-stream](https://es-incident.github.io/)\n- [peacenotwar](https://en.wikipedia.org/wiki/Peacenotwar)\n- ...and many more\n\n`npm-daycare` is an answer to those incidents: It slows down risky packages, and lets you keep building while new releases bake in public.\n\n## What npm-daycare does 🧩\n\n- **Age gate** – `daycare-filter` rejects package versions younger than a configurable number of hours so your CI never installs a just-published release.\n- **Download reputation** – `daycare-middleware` checks the npm download API and blocks packages falling below the weekly download floor you set.\n- **Verdaccio-native** – both plugins slot into Verdaccio, so you get a familiar proxy cache, upstream auth, and local publishing workflow.\n- **Zero-touch for developers** – once the registry URL changes, existing tooling (npm, pnpm, Yarn, Bun) works without extra configuration.\n\n## Getting started 🚀\n\n### 1. Run the proxy\n\n```bash\ndocker run --pull=always --rm -p 4873:4873 \\\n  -e MIN_AGE_HOURS=48 \\\n  -e MIN_WEEKLY_DOWNLOADS=10000 \\\n  --name npm-proxy bgodil/npm-daycare\n```\n\nEnvironment variables\n\n- `MIN_AGE_HOURS` (default `48`) – minimum publish age before a version becomes installable.\n- `MIN_WEEKLY_DOWNLOADS` (default `10000`) – minimum downloads in the last seven days.\n\n### 2. Point your tooling at npm-daycare\n\n```\nnpm   : npm set registry http://localhost:4873/\npnpm  : pnpm config set registry http://localhost:4873/\nyarn  : yarn config set registry http://localhost:4873/\nbun   : bun config set registry http://localhost:4873/\n```\n\nTo revert, reset each manager back to `https://registry.npmjs.org/`.\n\n### 3. Verify the proxy\n\n```bash\nnpm whoami --registry http://localhost:4873/ # should hit Verdaccio\nnpm view \u003cpackage\u003e --registry http://localhost:4873/ # confirms package visibility\n```\n\n## Caveats\n\nnpm-daycare should not be your only layer of defense. An npm package is a piece of software that you run on your computer, and you should treat it as such.\n\nThe tag handling logic is currently not very robust; if a tag's version is too new, the tag will not be returned, even if it previously had a version that was old enough. For the `latest` tag, there is a workaround which just returns the latest available version.\n\nPrivate packages are currently not supported. There is currently no authentication, so don't host the proxy in a public place.\n\n## Development 💻\n\nThis repository ships two Verdaccio plugins located in `daycare-filter` and `daycare-middleware`.\n\n- `daycare-filter` inspects incoming metadata and strips versions that fail the age policy before Verdaccio serves them.\n- `daycare-middleware` hooks the tarball fetch pipeline, queries download statistics, and rejects packages that lack adoption.\n\nInstall dependencies and run tests inside each plugin directory while contributing.\n\nTo build \u0026 run the proxy from source:\n\n```bash\n# Build the image\ndocker build -t npm-daycare ./\n\n# Run with sane defaults (48h age minimum, 5k weekly downloads)\ndocker run --rm -p 4873:4873 --name npm-proxy npm-daycare\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhexclave%2Fnpm-daycare","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhexclave%2Fnpm-daycare","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhexclave%2Fnpm-daycare/lists"}