safedep/pmg
View on GitHub ↗ ★ 563 Go
PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.
7 mentions on Hacker News by 2 people: 3 stories, 4 comments · first 2025-05-15 · latest 2026-10-21
20082026
-
Not sure about a service, but PMG enforces dependency cooldown and sandbox on package install. https://github.com/safedep/pmg
comment by abhisek · 2026-10-21 · in Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor -
…deal with while building sandbox (or any least privilege solution) to protect unbounded workloads. https://github.com/safedep/pmg
comment by abhisek · 2026-08-20 · in Malicious Rust crate Arrayref runs a build-time payload -
▲ 4
Show HN: PMG, open source package firewallstory by abhisek · 2026-07-21 · 2 comments
-
Building Package Manager Guard (PMG) - https://github.com/safedep/pmg With all the supply chain attacks on OSS ecosystems targeting developers, PMG is a practical protection using a combination of threat intel, policy and sandbox. It’s a…
comment by abhisek · 2026-07-13 · in Ask HN: What Are You Working On? (July 2026) -
…quite a few quirks involved due to Go routines when it comes to handling messages from the kernel. https://github.com/safedep/pmg
comment by abhisek · 2026-05-11 · in Ask HN: What are you working on? (May 2026) -
▲ 1
Show HN: NPM install is a security hole, so we built a guard for itstory by Sahil121 · 2026-03-26 · 0 comments
-
▲ 6
PMG: Wraps Package Managers to Prevent Installation of Malicious OSS Packagesstory by abhisek · 2025-05-15 · 0 comments