pc-style/supply-chain-guard

Supply Chain Guard is a command line tool that adds a manual review step before you install a package from npm or a VS Code extension. The worry it addresses is that an attacker can sneak malicious code into a package, and the moment you install it, that code runs on your machine. The guard downloads the package first, looks at the files that tend to matter during an install, writes reports about what it found, and only then lets the install go through. The author is clear that this is not a sandbox and that an approval is not a guarantee that a package is safe. It is described as a local tripwire for suspicious install behavior. You install it with a one-line curl command that runs an install script, then activate a shell hook so that commands like bun add, npm install, pnpm add, yarn add, and code --install-extension all flow through the guard first. The hook can be bypassed for a single command with an environment variable. There is also a doctor command that checks all the dependencies are in place, a config command to set defaults, and a clean command to delete cached files and reports. The tool can optionally consult two AI command line agents, Codex and PI, to give a second opinion on the package. The agent must end its review with a specific approval line, otherwise the install is blocked. It can also call Socket.dev, an external service that scores npm packages, if you provide an API token. The checks include install lifecycle scripts, suspicious text patterns like piped curl-to-shell, encoded payloads, credential paths, executable entries, large files, and VS Code extension activation hooks. There is also an active incident mode where you set an advisory string, and during that period every install requires you to type an exact acceptance phrase. The repository has 20 stars and is written in TypeScript.