01Point npm at the proxy
One command on your machine or in CI. npm, yarn, pnpm and bun all respect it — lockfiles included.
npm config set registry https://r.installsafe.ionpm install, without the malware.
One config line, and every npm install skips packages with known vulnerabilities and malware. Your package.json, lockfiles and CI stay exactly as they are.
$ npm config set registry https://r.installsafe.iofree plan · no credit card required · advisory data from OSV.dev
Rather talk it through? Book a 30-minute call
what happens on every install
vulnerable → fixed
machine · ci · agentrequest
$
→ GET /lodash
→ GET /lodash
r.installsafe.io · metadata filtered against OSV.dev, live
lodash@4.17.11GHSA-jf85-cpcp-j695
lodash@4.17.15GHSA-p6mc-m468-83gw
lodash@4.17.20GHSA-35jh-r3h4-6jhm
lodash@4.17.21 served
Installed · fixed
Installed 4.17.21
lodash@4.17.21 · 3 vulnerable versions hidden
Three vulnerable versions hidden from the metadata; npm resolved the range to the last clean release. Nothing to read, bump or obey.
314 npm packages were weaponised overnight. We blocked all of them.
The “mini Shai-Hulud” attack pushed malicious versions of 314 widely used packages onto npm, stealing cloud credentials, tokens and SSH keys from every machine that installed them — and some of those versions stayed live on the public registry for weeks.
0 / 314
compromised packages filtered for our users — every one, with nothing for them to do
220,326+
vulnerable and malicious versions kept out of builds to date
19,070+
clean installs served through the proxy
Within hours the advisories reached OSV.dev, and every compromised version disappeared from the metadata our users receive. No update to apply. No patch to chase. Nothing to do.
Weeks later, four of those versions were still live on the public registry. Behind Install Safe, they never existed.
This is the difference between a scanner and a filter: a scanner tells you the malware is on your disk. We make sure it never arrives.
$ npm install jest-canvas-mock@2.5.3 npm error code ETARGET npm error notarget No matching version found └─ malicious version · MAL-2026-4136 · filtered $ npm install jest-canvas-mock@^2 added 1 package in 380ms └─ resolved to 2.5.2 — last clean release
verified 11 Jun 2026 · advisory MAL-2026-4136
You already have npm audit. It tells you after the fact.
Every other tool in this category reports on what you installed. Install Safe changes what is installable — the bad version is gone from the metadata before your package manager ever picks a candidate.
| Criterion | npm audit | Dependabot alerts | Install Safe |
|---|---|---|---|
| When you find out | After the package is on disk | Hours to days after merge | Before resolution — the unsafe version isn’t offered |
| What you have to do | Read the report, bump, re-test | Review and merge a PR | Nothing. The range resolves to the nearest clean release |
| Malicious packages | Covered only once an advisory lands, and only as a warning | Alerts, no enforcement | Every version removed — the package does not exist for you |
| Malicious postinstall scripts | Already ran | Already ran | Never downloaded — for any version OSV flags |
| When an AI agent installs | Only if the agent reads the output | After the fact | Enforced below the agent — nothing to read or obey |
| Setup | Built in | Repo configuration | One registry URL |
When you find out
- npm audit
- After the package is on disk
- Dependabot alerts
- Hours to days after merge
- Install Safe
- Before resolution — the unsafe version isn’t offered
What you have to do
- npm audit
- Read the report, bump, re-test
- Dependabot alerts
- Review and merge a PR
- Install Safe
- Nothing. The range resolves to the nearest clean release
Malicious packages
- npm audit
- Covered only once an advisory lands, and only as a warning
- Dependabot alerts
- Alerts, no enforcement
- Install Safe
- Every version removed — the package does not exist for you
Malicious postinstall scripts
- npm audit
- Already ran
- Dependabot alerts
- Already ran
- Install Safe
- Never downloaded — for any version OSV flags
When an AI agent installs
- npm audit
- Only if the agent reads the output
- Dependabot alerts
- After the fact
- Install Safe
- Enforced below the agent — nothing to read or obey
Setup
- npm audit
- Built in
- Dependabot alerts
- Repo configuration
- Install Safe
- One registry URL
Install Safe uses the same advisory data as npm audit (GitHub Advisory Database via OSV.dev), plus the OpenSSF malicious-packages feed. Same intelligence, enforced earlier.
02We filter the metadata
Every request is matched against live advisory data. Vulnerable and malicious versions are removed before npm sees them.
lodash@4.17.11 4.17.11removed03npm picks a safe version
Ranges resolve to the nearest clean release automatically. A pinned bad version fails loudly, with the advisory ID.
lodash@^4 4.17.21cleanYour agent installs dependencies. Who’s reviewing them?
Coding agents run npm install on their own, at a pace no human reviews. They choose packages by pattern, not by provenance.
Attackers know it. They register the names models tend to hallucinate (“slopsquatting”), publish typosquats, and hijack abandoned libraries. To a model predicting tokens, malware looks fine.
Point your agent at Install Safe and that surface disappears. Hallucinated, typosquatted and compromised packages simply don’t exist behind the proxy — so the agent can’t install them, whatever it was told.
agent: adding dependencies… $ npm install express helmet lodahs npm error 404 'lodahs' is not in this registry └─ typosquat — flagged as malware, filtered agent: correcting… $ npm install express helmet lodash added 64 packages in 2.1s └─ every version checked against live advisories
works with any agent that shells out to npm
Or let the agent ask first.
The proxy refuses a bad version at install time. An agent that asks first never produces the failed install at all — it picks a clean version instead.
Point Claude Code, Cursor, or any MCP client at installsafe.io/mcp. No account, no API key, nothing to install — one URL and three tools: check_packages for advisories on exact versions, suggest_safe_version for the highest version without them, and scan_manifest for a whole lockfile.
It is optional. The proxy protects agents that have never heard of MCP, using the same config line as everything else.
agent: checking before install… check_packages lodash@4.17.11 blocked by the default policy · 7 advisories └─ GHSA-jf85-cpcp-j695 (critical) — fixed in 4.17.12 suggest_safe_version lodash 4.17.11 lodash@4.18.0 — no known advisories in OSV └─ agent installs this one instead
advisory data from OSV.dev, live, as of 2026-09-22
A proxy in your supply chain is a fair thing to be suspicious of.
So here is exactly what it does and does not do.
- Integrity
Your packages are never modified
Tarballs are served byte-for-byte from registry.npmjs.org, so lockfile integrity hashes keep matching. We only filter which versions are visible.
- Availability
It fails open
If advisory data is unreachable, installs pass through and the event is logged. Teams that prefer strict blocking can fail closed instead.
- Data
Public advisories, not our opinion
OSV.dev aggregates the GitHub Advisory Database — the data behind npm audit — with the OpenSSF malicious-packages feed. You can check every ID we act on.
- Reversibility
One command to leave
Set the registry back to npmjs.org and everything works as before. No lockfile rewrite, no migration, nothing to unpick.
- Control
You set the threshold
Block every advisory or only high and critical. Quarantine releases younger than N days. Allow or ban any package down to a semver range.
- Visibility
Full audit trail
Every version served to you and every one kept out, with the advisory IDs that triggered them — attributed per registry token.
Your registry, under your command.
Filtering is automatic. Everything around it — policy, visibility, team control — lives in one dashboard.
Decide what “too risky” means
- Severity threshold — block every advisory, or only high & critical — your call.
- Release quarantine — ignore versions younger than N days; most supply-chain malware is caught within a week of publishing.
- Allow & block rules — whitelist or ban any package, down to a semver range. Applied live within a minute.
protection policy
Block everythingany advisory, any severity
High & criticalserious only
Off3 days7 days · quarantine14 days
allow@acme/internal-ui*
blockleft-pad*
See every install. And every save.
- Live audit trail — every version served to you, every one kept out — with the advisory IDs that triggered them.
- Download analytics — 14-day activity, data transferred, all attributed per registry token.
- Registry tokens — one per machine or CI pipeline, stored as hashes, revocable in one click.
activity · 14 days
1,284installs
2.1 GBtransferred
115kept out
installedreact@19.2.02.4 MB
fixedlodash · 115 versions hidden, safe one served
blockedjest-canvas-mock@2.5.3malware
One policy. Every engineer.
- One org-wide policy — admins set it once and every member inherits it exactly — no per-developer drift.
- Slack alerts — every version kept out posts to your channel, with who, what, and which advisory.
- Centralized control — invite by email, see the whole team’s activity, revoke any member’s token instantly.
security-alerts
Install Safe · now
jest-canvas-mock@2.5.3 download denied for dev@acme.io — MAL-2026-4136
you@acme.ioownersets the baseline
dev@acme.iomember2 tokens
ci@acme.iomember1 token
Cheaper than one incident response.
A single credential-stealer that reaches a developer machine costs days of rotation, review and explaining. Start free and stay free if that is all you need.
Free
Everything you need to stop installing known-bad versions.
$0
free forever · no card required
- Secure installs through the proxy
- Live vulnerability & malware filtering
- Blocks Critical and High severity
- Activity dashboard, 7-day log
- One registry token
Pro
most popularFor working engineers who want the policy under their own control.
$19per month
7-day free trial · cancel anytime
- Everything in Free
- Configurable severity policy
- Release quarantine & package-age rules
- Package allow / block rules
- Activity dashboard & 90-day audit log
- Unlimited registry tokens
Team
One policy every engineer inherits, with no per-developer drift.
$25per seat / month
starts at 2 seats · add more any time
- Everything in Pro
- Org-wide policy: severity, quarantine, allow/block rules
- Slack alerts whenever a version is kept out
- Centralized member & token management
- Team-wide audit log
The things people ask before switching.
Something else on your mind? support@installsafe.io
01Do I have to change my workflow?
No. You set the registry once with npm config (or in a project .npmrc) and everything else stays the same — same commands, same lockfiles, same CI.
02What happens when a version I need is vulnerable?
If your range allows a safe release, npm resolves to it automatically and you usually won’t notice. If you pin an exactly-vulnerable version, the install fails with a clear error naming the advisory. That’s the point.
03Are my packages modified in any way?
Never. Tarballs are served byte-for-byte from registry.npmjs.org, so lockfile integrity hashes keep matching. We only filter which versions appear in the metadata.
04What if Install Safe goes down?
The proxy fails open: installs pass through and the event is logged, so an outage on our side never stops your build. Teams that prefer strict blocking can fail closed instead.
05Where does the vulnerability data come from?
OSV.dev — the open-source aggregator that combines the GitHub Advisory Database (the data behind npm audit) with the OpenSSF malicious-packages feed. CVEs and confirmed malware, updated continuously.
06Does it work with yarn, pnpm and bun?
Yes. Anything that respects the npm registry setting works, including yarn, pnpm, bun, and CI bots like Renovate.
07I let AI agents write my code. Does this help?
Especially then. Agents install packages without vetting them, and attackers target exactly that with typosquats and hallucinated package names. Behind the proxy those packages don’t exist, so an agent can’t install them no matter what it was told. Works with any agent that runs npm — and if you would rather the agent asked before installing than be refused during it, there is an MCP server at installsafe.io/mcp that answers whether a package has known advisories.
08How do I undo it?
Set your registry back to registry.npmjs.org. Nothing in your project changed, so there is nothing to migrate back.
Questions a page can’t answer? Talk to a human.
Thirty minutes, screen share optional. Book one whether you are evaluating this for fifty developers or you just want someone to walk you through it.
- a walkthrough
- self-hosting
- security review
- custom block policies
Book a 30-minute call
30 minutes · no sales team
Ship code, not CVEs.
Two minutes from now, every npm install on your machine can be immune to known vulnerabilities and malware.
versions kept out of builds to date0