safedep/pmgPMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.
Developers and AI coding agents install packages every day. Each npm install or pip install executes thousands of lines of code that nobody reviews.
Recent compromises in popular ecosystems:
PMG is free, open source (Apache 2.0), and requires no account or API key. It intercepts every package install and checks it against SafeDep's free community API for known malware before code executes. Install it once, and it covers every npm install, pip install, and poetry add after that.
PMG takes a defense in depth approach. Zero config, works across Zsh, Bash, and Fish, and each install passes through the enabled protection layers before code runs, plus an audit trail after.
npm, pip, and other package managers. Developers and AI agents use the same commands. No workflow changes.PMG is the only free, open-source, install-time package firewall that covers developers and AI agents alike and ships with sandboxing and cooldown out of the box.
| Capability | PMG | Socket | safe-chain | Snyk | Dependabot |
|---|---|---|---|---|---|
| OSS / built in public | ✓ | ✗ | ✓ | ✗ | ✗ |
| No account or API key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Install-time malicious package blocking | ✓ | ✓ | ✓ | ✗ | ✗ |
| Dependency cooldown policy | ✓ | ✗ | ✓ | ✗ | ✗ |
| Runtime sandboxing | ✓ | ✗ | ✗ | ✗ | ✗ |
| Protects AI coding agents transparently | ✓ | ✗ | ✗ | ✗ | ✗ |
| Local audit logs | ✓ | ✗ | ✗ | ✗ | ✗ |
| Known-CVE remediation PRs | ✗ | ✗ | ✗ | ✓ | ✓ |
curl -fsSL https://raw.githubusercontent.com/safedep/pmg/main/install.sh | sh
See Installation for Homebrew, npm, and other install methods.
Wire PMG into your shell so it intercepts package managers.
pmg setup install
# Restart your terminal to apply changes
Tip: Re-run
pmg setup installafter upgrading PMG to pick up new configuration options.Linux all-users / golden images:
sudo pmg setup install --system— see docs/system-install.md.
Validate your installation and verify protection is working:
pmg setup doctor
Optional: PMG inspects HTTPS traffic with an on-the-fly CA that it injects into package managers per run. To persist a single CA across runs and trust it in your OS trust store (needed for tools that ignore CA environment variables, such as Go on macOS and Windows), install it once:
pmg setup cert install # user scope, no sudo pmg setup cert status # check trust state and expirySee Certificate Authority for scopes, rotation, and removal.
See PMG blocking threats.
npm install --no-cache --prefer-online [email protected]
Note:
safedep-test-pkgis a benign test package flagged as malicious in SafeDep's database for testing and verification purposes.
Continue using your package managers as usual, or let your AI coding agent run them. PMG sits in the path, blocking malicious packages.
npm install express
# or
pip install requests
PMG supports the tools you already use:
| Ecosystem | Tools | Command Example |
|---|---|---|
| Node.js | npm | npm install <pkg> |
pnpm | pnpm add <pkg> | |
yarn | yarn add <pkg> | |
bun | bun add <pkg> | |
aube | aube add <pkg> | |
npx | npx <pkg> | |
pnpx | pnpx <pkg> | |
aubx | aubx <pkg> | |
aubr | aubr <script> | |
| Python | pip | pip install <pkg> |
pipx | pipx run <pkg> | |
poetry | poetry add <pkg> | |
uv | uv add <pkg> | |
uvx | uvx <pkg> |
Downloads the latest release from GitHub, verifies its SHA-256 checksum, and installs to $HOME/.local/bin (if on PATH) or /usr/local/bin.
curl -fsSL https://raw.githubusercontent.com/safedep/pmg/main/install.sh | sh
brew tap safedep/tap
brew install safedep/tap/pmg
npm install -g @safedep/pmg
Note: NPM-based installs can be fragile when Node.js is managed by version managers like
miseorasdf. The globalnpmbin path changes with the active Node version, so switching versions can leavepmgunavailable onPATH(or pointing to an old install). For these setups, prefer the install script or Homebrew.
# Ensure $(go env GOPATH)/bin is in your $PATH
go install github.com/safedep/pmg@latest
Download the latest binary for your platform from the Releases Page.
Prebuilt multi-arch (linux/amd64, linux/arm64) images are published to GitHub Container Registry on every release. The image entrypoint is pmg.
# Pull the latest image (or pin a version tag, e.g. :v1.2.3)
docker pull ghcr.io/safedep/pmg:latest
# Run any pmg command
docker run --rm ghcr.io/safedep/pmg:latest version
Protect CI workflows with one step. PMG analyzes every npm install,
pip install, etc. in the job.
- uses: safedep/pmg@v1
with:
server-mode: true
# intercepted via HTTP_PROXY automatically
- run: npm ci
- name: Enforce PMG policy
if: always()
run: pmg proxy stop --fail-on-violation # stops the daemon, fails the job on a block
By default you get malware blocking and dependency cooldown. Sandbox isolation
is opt-in via the sandbox input. Tune behavior via inputs (paranoid,
sandbox, cooldown-days, ...) or point
config-file at a YAML in the repo. See
docs/github-action.md for the full reference.
Remove shell integration:
pmg setup remove
To also remove the PMG configuration file:
pmg setup remove --config-file
Then uninstall PMG itself:
# Homebrew
brew uninstall safedep/tap/pmg
# NPM
npm uninstall -g @safedep/pmg
PMG builds are reproducible and signed.
If PMG saved you from a bad package, star this repo. It helps others find it.
Contributions welcome. See CONTRIBUTING.md for build and test instructions.
Thank you to all contributors ❤️
PMG collects anonymous usage data. To disable, either:
disable_telemetry: true in your PMG config file, orPMG_DISABLE_TELEMETRY=true.