https://github.com/safedep/pmg
PMG protects developers from getting hacked by malicious open source packages. Stop the next Shai-Hulud or S1ngularity before it happens.
https://github.com/safedep/pmg
developer-tools devsecops hacktoberfest malicious-code npm open-source pnpm supply-chain-security
Last synced: 4 months ago
JSON representation
PMG protects developers from getting hacked by malicious open source packages. Stop the next Shai-Hulud or S1ngularity before it happens.
- Host: GitHub
- URL: https://github.com/safedep/pmg
- Owner: safedep
- License: apache-2.0
- Created: 2025-03-20T02:29:47.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2026-02-16T16:03:28.000Z (5 months ago)
- Last Synced: 2026-02-16T23:41:21.296Z (5 months ago)
- Topics: developer-tools, devsecops, hacktoberfest, malicious-code, npm, open-source, pnpm, supply-chain-security
- Language: Go
- Homepage: https://safedep.io
- Size: 14.6 MB
- Stars: 98
- Watchers: 1
- Forks: 11
- Open Issues: 16
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Maintainers: MAINTAINERS.txt
Awesome Lists containing this project
- awesome-agent-sandboxes - pmg - level sandboxes. (What is sandboxing and why should you care? / Sandboxing alone isn't enough)
- awesome-software-supply-chain-security - safedep/pmg: Package Manager Guard wraps package managers (npm, pip, poetry, uv, etc.) to block malicious packages at install time using SafeDep's realtime malware analysis and threat detection
- awesome-starts - safedep/pmg - PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed. (developer-tools)
README
Package Manager Guard (PMG)
Prevent supply chain attacks before they happen.
[](https://docs.safedep.io/pmg/quickstart)
[](https://safedep.io)
[](https://discord.gg/kAGEj25dCn)
[](https://goreportcard.com/report/github.com/safedep/pmg)
[](https://api.securityscorecards.dev/projects/github.com/safedep/pmg)
[](https://github.com/safedep/pmg/actions/workflows/codeql.yml)
## Why PMG?
Modern software development relies heavily on open-source packages. However, standard package managers (`npm`, `pip`, etc.) prioritize convenience over security, executing arbitrary code (like `postinstall` scripts) on your machine without validation. This vector is frequently exploited by attackers to steal credentials or inject backdoors.
**PMG acts as a security middleware layer.** It wraps your package manager to:
1. **Analyze** packages for malware before they are installed.
2. **Sandbox** the installation process to prevent system modification.
3. **Audit** every package installation event.
## Quick Start
Get protected in seconds.
### 1. Install
**MacOS / Linux (Homebrew)**
```bash
brew install safedep/tap/pmg
```
**NPM**
```bash
npm install -g @safedep/pmg
```
> See [Installation](#installation) for additional methods.
### 2. Setup
Configure your shell to use PMG automatically.
```bash
pmg setup install
# Restart your terminal to apply changes
```
### 3. Use
Continue using your favorite package manager tools as usual. PMG works silently in the background.
```bash
npm install express
# or
pip install requests
```
If a malicious package is detected, PMG blocks it immediately:
```text
[PMG] Blocked malicious package: malicious-lib@1.0.0
[PMG] Reason: Known malware signature detected
```
## Features
| Feature | Description |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| **Malicious Package Protection** | Real-time protection against malicious packages using [SafeDep](https://docs.safedep.io/cloud/malware-analysis). |
| **Sandboxing** | Enforces least privilege using OS native sandboxing to contain installation scripts. |
| **Dependency Analysis** | Deep scans of direct and transitive dependencies before they hit your disk. |
| **Event Logging** | Keeps a verifiable audit trail of all installed packages. |
| **Zero Config** | Works out of the box with sensible security defaults. |
| **Cross-Shell** | Seamlessly integrates with Zsh, Bash, Fish, and more. |
## Supported Package Managers
PMG supports the tools you already use:
| Ecosystem | Tools | Status | Command Example |
| ----------- | -------- | ------ | ------------------- |
| **Node.js** | `npm` | Yes | `npm install ` |
| | `pnpm` | Yes | `pnpm add ` |
| | `yarn` | Yes | `yarn add ` |
| | `bun` | Yes | `bun add ` |
| | `npx` | Yes | `npx ` |
| | `pnpx` | Yes | `pnpx ` |
| **Python** | `pip` | Yes | `pip install ` |
| | `poetry` | Yes | `poetry add ` |
| | `uv` | Yes | `uv add ` |
## Installation
Homebrew (MacOS/Linux)
```bash
brew tap safedep/tap
brew install safedep/tap/pmg
```
NPM (Cross-Platform)
```bash
npm install -g @safedep/pmg
```
Go (Build from Source)
```bash
# Ensure $(go env GOPATH)/bin is in your $PATH
go install github.com/safedep/pmg@latest
```
Binary Download
Download the latest binary for your platform from the [Releases Page](https://github.com/safedep/pmg/releases).
## Trust and Security
Security is our first class requirement. PMG builds are reproducible and signed.
* **Attestations**: GitHub and npm attestations are used to guarantee artifact integrity.
* **Verification**: Users can cryptographically prove the binary matches the source code.
* See [Trusting PMG](docs/trust.md) for verification steps.
## Usage Guide
PMG runs transparently, but you can control it when needed.
### Paranoid Mode
Treat all unverified or suspicious packages as malicious.
```bash
pmg --paranoid npm install
```
### Dry Run
Simulate installation to check for malware without writing to disk.
```bash
pmg --dry-run npm install
```
### Debugging
Enable verbose logs for troubleshooting.
```bash
pmg --debug npm install
```
### Emergency Bypass
> ⚠️ **Warning**: Bypassing security checks exposes users to risk.
```bash
export PMG_INSECURE_INSTALLATION=true
npm install
```
## Advanced Documentation
* [Trusted Packages Configuration](docs/trusted-packages.md)
* [Proxy Mode Architecture](docs/proxy-mode.md)
* [Sandboxing Details](docs/sandbox.md)
## Contributing
Contributions are welcome! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on how to build and test PMG locally.
## Telemetry
PMG collects anonymous usage data to improve project stability and reliability.
To disable: `export PMG_DISABLE_TELEMETRY=true`.