# LavaMoat/LavaMoat

tools for sandboxing your dependency graph

Repository: https://github.com/LavaMoat/LavaMoat
Canonical: https://ross.abutalabs.com/products/lavamoat
Homepage: https://lavamoat.github.io/
Language: JavaScript
License: MIT
License Family: permissive
Last push: 2026-09-02T19:25:50+00:00

## Health v2 (maintenance only)
Score: 92/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 100, release rhythm 78, longevity 100
- inputs: {"age_days": 2811, "days_push": 0, "days_rel": 69, "gap_med": 0.0, "n_releases_24m": 247}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1218, forks 83 (observed 2026-09-03T02:15:06.483304+00:00)

## What it is
LavaMoat is a suite of tools for securing JavaScript projects against software supply chain attacks by sandboxing the dependency graph. It controls install script execution and uses SES compartments to restrict runtime access to JavaScript primordials and platform APIs per package.

## Use cases
- protect my npm project from malicious dependencies
- disable unexpected postinstall scripts in dependencies
- sandbox node.js dependency code at runtime
- prevent packages from modifying JavaScript primordials
- limit browser API access per npm package
- secure a JavaScript app against supply chain attacks
- generate a policy file for dependency capabilities

## When to choose
- you run a JavaScript/Node.js project with many npm dependencies and want supply chain protection
- you want to block malicious install scripts by default
- you need runtime sandboxing of dependencies without rewriting your app
- you maintain a high-value target like a crypto wallet or web app

## When to avoid
- your project is not JavaScript/Node.js based
- you need protection against vulnerabilities in trusted first-party code rather than dependencies
- your dependencies require broad platform access that makes policies impractical to maintain

## Facets
- artifact type: library
- maturity: active
- function: security, dependency-audit, developer-tools
- domain: security, web-development, developer-tools
- platform: browser
- tags: supply-chain-security, ses, npm-security, dependency-sandboxing, runtime-protection, sandbox, nodejs, javascript

## Member repositories
- LavaMoat/LavaMoat (main) score 92

## Provenance
- Observed fields: from GitHub, fetched 2026-09-03T02:15:06.483304+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:17:06.770748+00:00, confidence not recorded.
  - readme: https://github.com/LavaMoat/LavaMoat (fetched 2026-09-03T02:15:06.483304+00:00, sha f979e63870f4)
  - homepage: https://lavamoat.github.io/ (fetched 2026-08-29T12:24:48.664246+00:00, sha 09f9ad397c58)
  - registry_npm: https://registry.npmjs.org/lavamoat (fetched 2026-08-29T12:24:48.673202+00:00, sha 03a4efdcd06a)
- Data as of 2026-08-30T08:39:29.467469+00:00.