# Install Safe

> Install Safe (installsafe.io) is a drop-in npm registry proxy that strips vulnerable and malicious package versions from npm metadata in real time. Developers point npm at the proxy with one config line; every install then automatically skips packages with known CVEs and malware. Nothing else about the workflow changes — same commands, same lockfiles, same CI.

Last updated: 2026-08-22

## How it works

- You set the registry once: `npm config set registry https://r.installsafe.io` (or per-project in `.npmrc`).
- Every metadata request is checked against live OSV.dev advisory data — the aggregator combining the GitHub Advisory Database (the data behind `npm audit`) and the OpenSSF malicious-packages feed.
- Vulnerable and malicious versions are removed from the metadata before npm sees them, so version ranges resolve to the nearest clean release automatically. Exact pins of known-bad versions fail with a clear error.
- Tarballs are served byte-for-byte from registry.npmjs.org — packages are never modified, so lockfile integrity hashes keep matching.
- Works with anything that respects the npm registry setting: npm, yarn, pnpm, bun, and CI bots like Renovate.
- If advisory data is unreachable, the proxy fails open by default (installs pass through, the event is logged); teams can choose to fail closed.
- Protects AI coding agents too: typosquatted and hallucinated package names simply don’t exist behind the proxy, so an agent can’t install them.

## Pricing

- Free: free forever, no card required. Secure installs through the proxy, Live vulnerability & malware filtering, Blocks Critical and High severity, Activity dashboard, 7-day log, One registry token.
- Pro: $19 per month after a 7-day free trial. Everything in Free, Configurable severity policy, Release quarantine & package-age rules, Package allow / block rules, Activity dashboard & 90-day audit log, Unlimited registry tokens.
- Team: $25 per seat / month. Everything in Pro, Org-wide policy: severity, quarantine, allow/block rules, Slack alerts whenever a version is kept out, Centralized member & token management, Team-wide audit log.

Machine-readable pricing: https://installsafe.io/pricing.md

## Pages

- [Home](https://installsafe.io/): product overview, how it works, pricing, FAQ
- [Pricing](https://installsafe.io/pricing): plan comparison and billing questions
- [Free npm malware check](https://installsafe.io/scan): paste a package.json or lockfile and check every dependency for malware and known vulnerabilities against live OSV.dev advisory data — free, no account, nothing stored
- [Blog](https://installsafe.io/blog/): articles on npm supply-chain security, malware campaigns, and dependency hygiene
- [Privacy](https://installsafe.io/privacy): exactly what is collected and for how long
- [API documentation](https://installsafe.io/docs): the OpenAPI spec, the scanner API, the JSON error format, registry configuration, and every machine-readable file this site publishes

## Optional

- [Full text](https://installsafe.io/llms-full.txt): everything above plus the complete FAQ in one file
- [OpenAPI spec](https://installsafe.io/openapi.json): the free scanner as an API — POST a manifest to /api/scan, no auth, 10 scans per IP per 10 minutes
- [API catalog](https://installsafe.io/.well-known/api-catalog): RFC 9727 linkset pointing at the API description and its docs
- [Markdown](https://installsafe.io/docs.md): every page on this list also answers to `Accept: text/markdown` at its own URL