Safe-install – safer NPM installs with trusted build dependencies

Name: Safe-install – safer NPM installs with trusted build dependencies
Availability: InStock
Author: gkiely

by gkiely·May 12, 2026·19 points·5 comments

Visit Project View on HN

AI Analysis

●●SolidSolve My Problem

Brings Bun-style trusted dependencies to npm without switching package managers.

Strengths

•Moves trust decisions into version-controlled package.json instead of global config.
•Detects exotic sub-dependencies using git: or file: protocols automatically.

Weaknesses

•Adds an extra npm script step instead of integrating directly into the install flow.
•Relies on users manually reviewing script output before updating the allowlist.

Post Description

In light of the ongoing npm supply chain compromises, I built safe-install:

https://www.npmjs.com/package/@gkiely/safe-install

It brings a couple of protections I wanted from npm but are not built in.

Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts:

https://bun.com/docs/guides/install/trusted

It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:

https://gajus.com/blog/3-pnpm-settings-to-protect-yourself-f...

I was hoping npm would eventually add something like this, but it does not seem to be happening soon, so I made a small package for it.