LavaMoat/LavaMoat

Health v2 · maintenance only

Adoption not part of the score

1218 stars · 83 forks observed · 2026-09-03

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

LavaMoat is a suite of tools for securing JavaScript projects against software supply chain attacks by sandboxing the dependency graph. It controls install script execution and uses SES compartments to restrict runtime access to JavaScript primordials and platform APIs per package.

Use cases

• protect my npm project from malicious dependencies
• disable unexpected postinstall scripts in dependencies
• sandbox node.js dependency code at runtime
• prevent packages from modifying JavaScript primordials
• limit browser API access per npm package
• secure a JavaScript app against supply chain attacks
• generate a policy file for dependency capabilities

When to choose

• you run a JavaScript/Node.js project with many npm dependencies and want supply chain protection
• you want to block malicious install scripts by default
• you need runtime sandboxing of dependencies without rewriting your app
• you maintain a high-value target like a crypto wallet or web app

When to avoid

• your project is not JavaScript/Node.js based
• you need protection against vulnerabilities in trusted first-party code rather than dependencies
• your dependencies require broad platform access that makes policies impractical to maintain

Facets

library · maturity active

security dependency-audit developer-tools security web-development developer-tools browser supply-chain-security ses npm-security dependency-sandboxing runtime-protection sandbox nodejs javascript

Member repositories

For agents

markdown · JSON · MCP: product_card(name="LavaMoat/LavaMoat")