Block malicious npm and pip packages before they install.
Defense in depth for the package managers you already use.

Why PMG?

Developers and AI coding agents install packages every day. Each npm install or pip install executes thousands of lines of code that nobody reviews.

Recent compromises in popular ecosystems:

• Mini Shai-Hulud - 300+ popular packages compromised
• litellm 1.82.8 - a popular AI proxy library compromised to exfiltrate credentials
• telnyx 4.87.2 - a legitimate telecom SDK hijacked on PyPI
• pino-sdk-v2 - a typosquat package disguised as the popular pino logger

PMG is free, open source (Apache 2.0), and requires no account or API key. It intercepts every package install and checks it against SafeDep's free community API for known malware before code executes. Install it once, and it covers every npm install, pip install, and poetry add after that.

How PMG Works

PMG takes a defense in depth approach. Zero config, works across Zsh, Bash, and Fish, and each install passes through the enabled protection layers before code runs, plus an audit trail after.

How PMG Compares

PMG is the only free, open-source, install-time package firewall that covers developers and AI agents alike and ships with sandboxing and cooldown out of the box.

Quick Start

1. Install

curl -fsSL https://raw.githubusercontent.com/safedep/pmg/main/install.sh | sh

See Installation for Homebrew, npm, and other install methods.

2. Setup

Wire PMG into your shell so it intercepts package managers.

pmg setup install
# Restart your terminal to apply changes

Tip: Re-run pmg setup install after upgrading PMG to pick up new configuration options.

Linux all-users / golden images: sudo pmg setup install --system — see docs/system-install.md.

Validate your installation and verify protection is working:

Optional: PMG inspects HTTPS traffic with an on-the-fly CA that it injects into package managers per run. To persist a single CA across runs and trust it in your OS trust store (needed for tools that ignore CA environment variables, such as Go on macOS and Windows), install it once:

pmg setup cert install          # user scope, no sudo
pmg setup cert status           # check trust state and expiry

See Certificate Authority for scopes, rotation, and removal.

3. Use

See PMG blocking threats.

Note: safedep-test-pkg is a benign test package flagged as malicious in SafeDep's database for testing and verification purposes.

Continue using your package managers as usual, or let your AI coding agent run them. PMG sits in the path, blocking malicious packages.

npm install express
# or
pip install requests

Supported Package Managers

PMG supports the tools you already use:

Installation

curl -fsSL https://raw.githubusercontent.com/safedep/pmg/main/install.sh | sh

brew tap safedep/tap
brew install safedep/tap/pmg

npm install -g @safedep/pmg

# Ensure $(go env GOPATH)/bin is in your $PATH
go install github.com/safedep/pmg@latest

# Pull the latest image (or pin a version tag, e.g. :v1.2.3)
docker pull ghcr.io/safedep/pmg:latest

# Run any pmg command
docker run --rm ghcr.io/safedep/pmg:latest version

GitHub Actions

Protect CI workflows with one step. PMG analyzes every npm install, pip install, etc. in the job.

- uses: safedep/pmg@v1
  with:
    server-mode: true

# intercepted via HTTP_PROXY automatically
- run: npm ci

- name: Enforce PMG policy
  if: always()
  run: pmg proxy stop --fail-on-violation   # stops the daemon, fails the job on a block

By default you get malware blocking and dependency cooldown. Sandbox isolation is opt-in via the sandbox input. Tune behavior via inputs (paranoid, sandbox, cooldown-days, ...) or point config-file at a YAML in the repo. See docs/github-action.md for the full reference.

Uninstallation

Remove shell integration:

To also remove the PMG configuration file:

pmg setup remove --config-file

Then uninstall PMG itself:

# Homebrew
brew uninstall safedep/tap/pmg

# NPM
npm uninstall -g @safedep/pmg

Trust and Security

PMG builds are reproducible and signed.

• Attestations: GitHub and npm attestations guarantee artifact integrity.
• Verification: You can cryptographically prove the binary matches the source code.
• See Trusting PMG for verification steps.

User Guide

• Configuration
• Trusted Packages Configuration
• Dependency Cooldown
• Caching
• Proxy Mode Architecture
• Persistent Proxy Server
• Certificate Authority
• Sandboxing

Support

If PMG saved you from a bad package, star this repo. It helps others find it.

Star History

Contributing

Contributions welcome. See CONTRIBUTING.md for build and test instructions.

Thank you to all contributors ❤️

Telemetry

PMG collects anonymous usage data. To disable, either:

• Set disable_telemetry: true in your PMG config file, or
• Export PMG_DISABLE_TELEMETRY=true.