AikidoSec/safe-chain

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1725 stars · 110 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Aikido Safe Chain is a free, tokenless CLI tool that wraps package managers (npm, yarn, pnpm, npx, pip, uv, poetry, and more) to block malicious packages from being installed on developer machines and CI/CD. It blocks newly published packages (under 48 hours old) that match known malware indicators without breaking builds or sharing build data.

Use cases

• protect developer laptops from malicious npm packages
• block supply chain attacks in CI/CD pipelines
• prevent installing malware via pip or poetry
• secure npx and uvx package execution
• guard against typosquatting and malicious dependency installs
• add malware scanning to package installation without tokens or accounts

When to choose

• you want free, tokenless protection against malicious package installs across npm and PyPI ecosystems
• you need to secure both developer workstations and CI/CD runners
• you want a lightweight wrapper around existing package managers rather than a full security platform

When to avoid

• you need coverage beyond npm and PyPI, such as Maven, NuGet, Go, or Ruby (consider Aikido Device Protection instead)
• you require centralized policy management, approvals, and org-wide visibility
• you need full SCA, SAST, or vulnerability scanning rather than install-time malware blocking

Facets

cli-tool · maturity active

security dependency-audit cli developer-tools security developer-tools windows cli cross-platform python supply-chain-security malware-blocking package-manager-wrapper npm pypi sca ci-cd-security free-tool command-line automation linux macos nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="AikidoSec/safe-chain")