Safer npm installs with trusted dependencies and script blocking

Supply chain attacks targeting npm packages have surged in recent years, exposing developers to risks from malicious dependencies. In response, a new open-source tool called safe-install introduces stricter controls for npm installations, allowing teams to block untrusted scripts by default while permitting trusted ones.

Why safe-install addresses a critical gap in npm

Unlike standard npm installations, which execute package scripts without restrictions, safe-install enforces a whitelist-based approach. By default, it disables all install and build scripts unless they are explicitly approved. This mirrors protections found in alternative package managers like Bun, which also prioritizes security by restricting script execution.

The tool’s configuration allows developers to maintain flexibility while reducing exposure. Users can specify which dependencies are permitted to run scripts, ensuring that only vetted packages execute installation logic. This granular control helps mitigate risks from typosquatting, compromised packages, or supply chain exploits that target build pipelines.

Blocking exotic sub-dependencies to prevent hidden risks

In addition to script restrictions, safe-install introduces a feature inspired by pnpm’s blockExoticSubdeps setting. This blocks installation of unusual or unexpected sub-dependencies that may contain malicious code. By preventing obscure packages from slipping into a project, the tool reduces the attack surface for supply chain attacks.

Developers can configure the tool to reject dependencies that don’t meet predefined criteria, such as known package names or cryptographic hashes. This proactive approach aligns with modern security practices, where proactive blocking of high-risk packages is preferred over reactive cleanup after an incident.

How safe-install compares to existing solutions

While npm remains the dominant package manager, its ecosystem has faced criticism for lacking built-in protections against supply chain threats. Safe-install fills this void by offering features that npm users have long requested but are not yet part of the core tool. The package’s approach contrasts with alternatives like Yarn or pnpm, which require manual configuration to achieve similar security postures.

The tool’s design emphasizes simplicity and compatibility. It integrates seamlessly with existing npm workflows, requiring minimal setup to enhance security. For teams already using npm, this provides an immediate way to harden installations without switching package managers.

Looking ahead: will npm adopt similar protections?

The absence of native script-blocking features in npm has left many developers seeking third-party solutions. Safe-install demonstrates the demand for stricter default security in package management, but its existence also highlights a gap in npm’s roadmap. Whether the npm team will integrate similar protections remains uncertain.

For now, tools like safe-install offer a pragmatic way to mitigate supply chain risks. As the npm ecosystem evolves, the broader adoption of security-first defaults could redefine how developers approach dependency management.