robert-auger/safer-dependencies

Safer-dependencies is a security add-on for Claude Code that checks any software package the AI tries to add to your project before it becomes a real risk. When an AI coding assistant adds a dependency, it often picks a version without checking whether that version has known vulnerabilities, whether the package name is a near copy of a popular one set up to trick people, or whether the package has been abandoned by its maintainers. This tool sits between Claude and your project files and runs those checks automatically. When Claude is about to add a package, the tool runs five checks: it confirms the package comes from the official registry and is not a typo based lookalike, it picks the newest stable version that has been out for at least seven days rather than something just published, it scans for known vulnerabilities using the OSV database plus tools native to each ecosystem, it verifies file hashes for pinned Python packages where possible, and it flags or blocks packages that are known to be abandoned or have had no stable release in over two years. Every check gets written to a monthly audit log on your machine. It works across npm, PyPI, RubyGems, Maven, Go, Rust, and PHP's Composer. There are several operating modes: a manual mode that runs the checks inline as Claude writes code, an automatic intercept mode that corrects a manifest file right after Claude writes it using a hook, and a pre install mode that checks package manager commands like npm install before they run and can block the install outright if a pinned version is known to be vulnerable. The project is source available rather than open source under a standard license. You can use and modify it freely, including inside a company or a product you sell, but a separate paid license is required if you want to sell the tool itself, bundle it into a paid product, or offer its functionality to others as a hosted service. It requires Claude Code and Python to run its checking scripts.