Technology Radar
Safe Chain is a free tool from Aikido that wraps the package managers for Node.js and Python, such as npm, pnpm, Bun, pip and uv. It sends package downloads through a local proxy that blocks versions published in the last 48 hours and any package Aikido's open threat feed lists as malicious. Worms such as Shai-Hulud have shown how quickly a compromised package can spread, and a short delay gives scanners time to catch a bad release. Most package managers now have a minimum release age setting, and teams should configure it in their projects. Safe Chain covers what those settings miss, such as a one-off npx command outside any project, or malicious packages older than the age limit.
Safe Chain covers only two ecosystems, but both have been targets of supply chain attacks. A version blocked for its age produces only a generic notice that packages were suppressed. Teams pulling through a private mirror with its own age limit gain little, and the malware blocking depends on a single vendor's feed. Safe Chain is licensed under the AGPL or a commercial license, so check the terms before building it into anything you distribute.
