About the Install Safe blog

This is the engineering blog of Install Safe, a drop-in npm registry proxy that strips vulnerable and malicious package versions out of npm metadata before npm install can resolve them.

We write about the npm supply chain: how compromised packages actually reach production, what the tooling in this space does and does not catch, and what the research says when you read past the vendor claims.

Who writes this

Prasanna Mestha, who builds Install Safe. The work behind these posts is the same work behind the product — reading OSV.dev advisory data, watching what gets blocked at the registry layer, and figuring out where existing tools leave gaps.

Disclosure

Install Safe is a commercial product, and it appears in the comparison posts on this blog — usually near the top, because these posts are written from the position that blocking a bad package at the registry is stronger than reporting it after install.

You should read those rankings with that in mind. What we try to do instead of pretending to be neutral: name the trade-offs of our own product as plainly as everyone else's, link to competitors so you can check their claims directly, and cite primary sources rather than each other's marketing pages.

How tools get evaluated

• Where the tool stops risk. Registry, CI, IDE, or pull request — this matters more than feature-list length, and it is the axis most comparisons skip.
• What it costs in noise. A scanner that surfaces everything is a scanner people stop reading.
• Published evidence over vendor copy. Where a claim has research behind it, we cite the paper or the primary source, with dates.
• Public pricing where it exists. Sales-led pricing gets said so rather than guessed at.

Corrections

If something here is wrong — a stale benchmark, a feature that shipped since publication, a mischaracterised product — tell us and we will correct it and say what changed. Vendors are welcome to write in about their own tools.

Contact: installsafe.io