flatt-security/setup-takumi-guard-npm

Protect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.

Harden your package manager configs against supply chain attacks.

GitHub Action to publish to NPM

Install pnpm and a JavaScript runtime (Node.js, Bun, or Deno) in one GitHub actions step

Supply Chain Firewall (SCFW) is a tool for preventing the installation of malicious npm and PyPI packages 🔥

Audit NPM, Yarn, PNPM, and Bun dependencies in continuous integration environments, preventing integration if vulnerabilities are found at or above a configurable threshold while ignoring allowlisted advisories

PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.

Fail CI when dependencies in your lockfile lose npm provenance or trusted publisher status

GitHub Action that detects the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain attacks. Scans dependencies, lockfiles and CI workflows against a daily-updated database of 1,200+ compromised packages, flags malicious install scripts, TruffleHog secret theft and SHA1HULUD runners. SARIF output for GitHub Code Scanning.