Stop triaging installs that should never have happened.
Your backlog is full of findings for packages that are already on developer machines and already in builds. The work is not detection — you have plenty of detection. The work is everything that follows it.
$ npm config set registry https://r.installsafe.ioPlain-text version for scripts and agents.
Detection was never the bottleneck
A finding arrives after the install, which means the remediation path runs through someone else’s sprint. You file the ticket, chase it, and get told it is not exploitable in this context. Repeat several hundred times a quarter.
Meanwhile the install script already ran. For a credential stealer — the category that has driven most npm incidents — detection after the fact is not a partial win, because the secret left the building at install time.
Moving the control to install time
- 01
Policy at the registry, not in a ticket
Severity threshold, minimum release age, explicit allow and block rules — enforced when the package is requested. A version your policy rejects is never served, so there is nothing to triage.
- 02
One policy every engineer inherits
Set org-wide rather than per developer, so there is no per-machine drift to audit and no honour system to rely on.
- 03
The trail you actually need
Every install and every block recorded per user and per token, with the advisory IDs. Enough for an audit question, without asking developers to log anything.
What about the vulnerabilities that are already in our tree?
This does not remove them, and nothing that sits at install time can. Point the free scanner at your lockfiles to see what is there today — that inventory is the existing work, and you likely have a tool for it already.
What changes is the inflow. The findings you would otherwise triage next quarter are the ones that never get installed, which is the only part of this problem that compounds in your favour.
What it costs
Free
Everything you need to stop installing known-bad versions.
free forever · no card required
- Secure installs through the proxy
- Live vulnerability & malware filtering
- Blocks Critical and High severity
- Activity dashboard, 7-day log
- One registry token
Pro
most popularFor working engineers who want the policy under their own control.
7-day free trial · cancel anytime
- Everything in Free
- Configurable severity policy
- Release quarantine & package-age rules
- Package allow / block rules
- Activity dashboard & 90-day audit log
- Unlimited registry tokens
Team
One policy every engineer inherits, with no per-developer drift.
starts at 2 seats · add more any time
- Everything in Pro
- Org-wide policy: severity, quarantine, allow/block rules
- Slack alerts whenever a version is kept out
- Centralized member & token management
- Team-wide audit log
Questions, answered.
Something else? support@installsafe.io
01Does this replace our SCA scanner?
No, and it is not trying to. A scanner takes inventory of what is in the tree; this refuses to add more. Teams generally keep both, and the scanner’s queue gets shorter.
02What is the failure mode if the proxy is down?
Installs fail the way they would if the registry were down, and the proxy fails open when advisory data is unreachable rather than blocking every install in the org. We publish that behaviour rather than implying total coverage.
03How do developers request an exception?
An allow rule for a specific package or version, set on the account. It is deliberate and recorded, so exceptions stop being invisible decisions made under deadline pressure.
04Where does the advisory data come from?
OSV.dev, the open advisory database, with a local mirror so a single outage does not blind the gate. The same data your scanner most likely uses.
Shrink the queue at the source.
Start free, or put a team behind one policy from $19 a month.