# npm-install-safe

> npm-install-safe ===

Latest version **0.0.0-super-duper-alpha-may-mess-up-publish-0** (published 2021-02-22) · ISC license · 0 weekly downloads

## Install

```sh
npm install npm-install-safe
pnpm add npm-install-safe
yarn add npm-install-safe
bun add npm-install-safe
```

Provides the command `npm-install-safe`.

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.0.0-super-duper-alpha-may-mess-up-publish-0 |
| Published | 2021-02-22 |
| First published | 2021-02-22 |
| Weekly downloads | 0 |
| License | ISC |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 1 |
| Unpacked size | 10.4 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | Moshe Kolodny |
| Maintainers | kolodny |

## Links

- npm: https://www.npmjs.com/package/npm-install-safe
- Repository: https://github.com/kolodny/npm-install-safe
- Homepage: https://github.com/kolodny/npm-install-safe#readme
- Issues: https://github.com/kolodny/npm-install-safe/issues
- npm.io page: https://npm.io/package/npm-install-safe

## Dependencies (1)

- [inquirer](https://npm.io/package/inquirer.md) 7.3.3

## Recent versions

- 0.0.0-super-duper-alpha-may-mess-up-publish-0 (latest) — 2021-02-22
- 0.0.0-super-duper-alpha-may-mess-up-publish — 2021-02-22

## README

npm-install-safe
===

Npm Install Safe is an experiment to attempt to secure npm installs against malicious and/or compromised packages.

At the moment the full source is under 200 LOC and is provides the most basic of defence against "bad" npm installs.

### How it works

`npm-install-safe` Does a  regular `npm install` with the [`--ignore-scripts`](https://docs.npmjs.com/cli/v6/commands/npm-install#:~:text=--ignore-scripts) flag set. This flag "will cause npm to not execute any scripts defined in the package.json"

Once that's done, `npm-install-safe` will inspect the installed modules and determine which modules have an install/postinstall script(s). The user is then prompted to select which packages they'd like to allow to run the install/postinstall script(s).

The selection is also saved in an "npm-install-safe" property in package.json to remember the users selection. This is only done when the package is pinned to the registry by the specific version so authors can't pull a switcheroo.

You can whitelist an entire package name if you want to always trust it. If a popular library which you feel comfortable trusting will never be compromised, would make sense to add to this whitelist. To whitelist `webpack`, add this to the "npm-install-safe" field: `"webpack@*"`

You can also blacklist a specific package or all version the same way by adding a `-` to  
that array: `["-core-js@*", "-styled-components@4.4.1"]`.

For convenience and to ease onboarding of this tool, you can also set the `NPM_INSTALL_SAFE_ALLOW_ALL` variable to blanket allow/whitelist all dependencies in the install step.

The source at the moment is under 200 LoC so please take a look to better understand (and prod) at the inner workings.

### Note

This package only has a dependency on `inquire` for the user input. If that changes down the line, the other dependencies will be included in the readme along with a justification of why it couldn't be helped.

## Install

This package should be installed globally with the `-g` flag:

```bash
npm install -g npm-install-safe
```

Optionally if you wanted to always have protection against bad actors even when using the regular `npm install` command, you can use the following bash function (add it to your `.bashrc`/`.zshrc`/`.profile`):

```bash
npm() {
  if [[ $1 == "i" || $1 == "install" ]]; then
    command npx npm-install-safe "$@"
  else
    command npm "$@"
  fi
}
```

## Contributing

I'm happy to take contributions in any form for this project. There are a couple of items where I probably need it more than others:

I'm not a security expert by any means. I'd be happy for help hardening this package against folks trying to break it and what it's trying to save against. I'm also looking for help on the bash function to be able to get this to shadow the standard `npm install` command. What I have works for my setup (oh-my-zsh) in my use cases but I'm probably missing so many edge cases and environments/shells.

Always happy for help on documentation as well.

---
_Source: https://npm.io/package/npm-install-safe · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._