Engineering
The Rules That Moved safedep.io from Astro to Next.js 16
Lint before code, useEffect banned, complexity capped at 15, clicks 2.4× faster, and an interactive guide to choosing your Next.js caching setup.
SafeDep Threat Intel is liveThreat Intel is liveExplore
Your biggest AppSec blind spot is the code you never wrote.
Attackers don't target your code. They target what you install: packages, MCP servers, IDE and agent extensions. SafeDep blocks malicious packages at every entry point, before they run.
No credit cardFree forever for individual useStart with GitHub
Featured in
Caught in the wildThis isn't theoretical.
This isn't theoretical.
We find it in real time.
SafeDep analyzes every package published to the major registries, around the clock. Our research team publishes the breakdown, often before the ecosystem has an advisory.
npmMini Shai-Hulud Strikes Again: 317 npm Packages CompromisedOne compromised maintainer account published 637 malicious versions.317 packages
PyPIMalicious litellm 1.82.8: Credential Theft and Persistent BackdoorA .pth file triggers credential theft the moment the package installs.AWS + K8s secrets- npmShai-Hulud 2.0 npm Supply Chain Attack Technical AnalysisSelf-replicating malware in zapier-sdk, @asyncapi, posthog and @postman.25,000+ repos
- Packages Scanned
- 20M+
- Components Analysed
- 500K+
- Projects Secured
- 5000+
- Avg Detection Lead
- 14hr
The problemMalicious code doesn't break in.
Malicious code doesn't break in.
It gets installed.
Third-party code arrives at every hand-off in your pipeline, from a developer's terminal to an org-wide registry. Each arrival is an execution, and none of it was reviewed by anyone on your team.
Developer machine
What gets in- npm / PyPI installs
- IDE extensions
- MCP servers
AI coding agent
What gets in- agent skills
- plugins
- tools it invokes
Repository / PR
What gets in- new dependencies
- transitive deps
CI/CD pipeline
What gets in- build-time pulls
- base images
Registry / org-wide
What gets in- everything pulled
- shared caches
Five entry points. One unchecked component is enough.
The answer
SafeDep guards the same five stages.
One policy, enforced everywhere the component travels, so it is inspected before it runs, merges, builds or spreads across the org.
- Dev machine
Blocked on install
malicious package firewall - AI agent
Blocked in-agent
skills, plugins, MCP vetted - Repo / PR
Blocked at PR
policy check on new deps - CI/CD
Blocked at build
gate before artifacts ship - Org-wide
Blocked org-wide
one policy, every team
Why SafeDepPick a layer.
Pick a layer.
See what SafeDep does there.
Credential theft, reverse shells, data exfiltration. These are purpose-built attacks, not bugs a vulnerability scanner can match against a database. Every screen below is the real product.
Block the install, on every machine
SafeDep sits in front of npm, pnpm, pip, uv, bun and other package managers and blocks malicious packages at install time, before any post-install script runs. Every decision lands in one fleet view, alongside a live feed of what was just blocked and where.
- Refused at install time, not flagged next week
- Laptops, CI runners and servers in one view
- Live feed of blocked packages, per endpoint
Every package your agent pulled, with a verdict
SafeDep MCP checks each package an agent wants before it installs. The advisory trail shows which agent asked for what, so a malicious pull is attributed rather than anonymous.
- A verdict per package, attributed to the agent
- Works with Claude Code, Cursor and Windsurf
- Malicious packages refused, not merely flagged
See the AI tooling nobody registered
vet inventories what each machine actually has loaded: coding agents, MCP servers and CLI tools, with scope and version. None of it appears in a lockfile, so none of it shows up in a repo scan.
- Coding agents, MCP servers and CLI tools discovered
- Scoped per machine, per project and per user
- An inventory snapshot, not your source code
Every dependency reviewed before it merges
The GitHub App posts a summary on each pull request: malware, vulnerability and license checks, with a verdict per package. It runs as a required check, so nothing reaches main unreviewed.
- Malware, vulnerability and licence in one report
- A verdict per package, posted on the pull request
- A required check, so nothing merges unreviewed
The build fails before the install lands
SafeDep runs as a proxy in the pipeline and intercepts every package install. A malicious package is stopped before it reaches the runner, and the job exits non-zero on the policy violation.
- Installs intercepted, not audited after the fact
- Blocked before it ever touches the runner
- Fails the job on any policy violation
Open coreStart on your laptop.
Start on your laptop.
Roll out to the org.
Every enforcement point is open source and auditable, so there is nothing to take on trust. SafeDep Cloud is what turns those same tools into protection for a whole organization.
Open source
For the individual developer
The command-line tools that do the actual blocking. Free forever, and yours to read.
brew install safedep/tap/pmg- Block malicious installs on your own machine
- Scan any repo or pipeline with policy-as-code
- Guardrails for your AI coding agent
- Apache-2.0, no account, no telemetry
SafeDep Cloud
For the security team
Everything in the open source tools, plus the org-wide layer: which components exist, who pulled them in, what policy blocked what, and proof for the audit.
- One policy enforced at every entry point
- Org-wide inventory and component lineage
- Exceptions, approvals and audit history
- SSO, tenants and role-based access control
Works across your stack
Latest from SafeDep
Read the blogThreat research from the supply chain frontline
Malware
wfx: GitHub Actions Credential Stealer Hits 8,000 Repos
Since November 10, 2026, an attacker has used stolen GitHub tokens to push a credential stealer into more than 8,000 repositories. It runs once in GitHub Actions or on npm install, sends secrets and cloud credentials to the attacker, and leaves cloud backdoors. Then the attacker reverts the commit.
Malware
Compromised bee-js and Swarm Desktop Steal Swarm Wallet Keys
Version 13.3.0 of @ethersphere/bee-js, the JavaScript client for Swarm, added a postinstall hook that steals the Swarm node wallet key and installs a remote-access backdoor. Swarm Desktop 0.56.2 shipped the same loader.
Ship code.
Not malware.
Start free with open source tools on your machine. Scale to a unified platform for your organization.
