[{"data":1,"prerenderedAt":170},["ShallowReactive",2],{"project-48359478":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":39,"post_text":41,"what":42,"said":69,"maker_in_thread":107,"shape":117,"grid":120,"attempts":133,"same_week":134,"maker_shows":35,"maker_hidden":163,"reader_version":164,"card":165},"48359478","DepsGuard","One command to harden NPM\u002Fpnpm\u002Fyarn\u002Fbun\u002Fuv configs","title","Show HN: DepsGuard – One command to harden NPM\u002Fpnpm\u002Fyarn\u002Fbun\u002Fuv configs","https:\u002F\u002Fgithub.com\u002Farnica\u002Fdepsguard","github.com","eranation",1780333132,2026,40,7,1387,4366,32,"shown","security_privacy","supply chain hardening","cli",[24,25,26,27,28],"npm supply chain","minimum release age","pnpm config","ignore-scripts","cooldown","quiet",null,{"positive":32,"neutral":33,"mixed":34,"critical":33},2,0,1,3,{"idea":37,"execution":38},{"positive":32,"critical":33},{"positive":33,"critical":33},[40,33,35,33,33,40,33],5,"I kept seeing every npm\u002Fpnpm\u002Fyarn\u002Fbun\u002Fuv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are \"controversial\", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the \"it won't happen to me\" syndrome (or \"I'll do it later, it seems complicated\" where it's actually very simple). So I created a tool that checks what you have ",{"problem":43,"audience":49,"pricing":53,"motivation":57,"time_to_build":30,"stack":61,"openness":66,"stage":67,"team_size":68},{"value":44,"source":45,"evidence":46},"Package manager configs lack supply chain safety settings like minimum release age and ignore-scripts, and each tool formats them differently","maker",[47],{"id":48},"post",{"value":50,"source":45,"evidence":51},"Developers using npm, pnpm, yarn, bun or uv, including those who vibe code",[52],{"id":48},{"value":54,"source":45,"evidence":55},"Free, MIT licensed, no account or telemetry",[56],{"id":48},{"value":58,"source":45,"evidence":59},"Maker found people repeatedly failed to follow cooldown advice for package managers",[60],{"id":48},[62],{"value":63,"source":45,"evidence":64},"Rust",[65],{"id":48},"open_source","launched","unknown",{"praise":70,"objections":86,"requests":94,"questions":101,"alternatives":102},[71,79],{"value":72,"source":73,"evidence":74},"Line about saving someone from a supply chain attack is great and security tooling's unseen wins are a real problem","commenter",[75],{"id":76,"by":77,"text":78},"48368376","craftedcode","The \"did it save someone from a supply chain attack? Also probably yes\" line is great. The problem with security tooling is exactly this — you never see the attack you prevented.",{"value":80,"source":73,"evidence":81},"Useful for verifying settings already set manually",[82],{"id":83,"by":84,"text":85},"48376243","jcjmcclean","I love this! Although I've already gone through and made manual updates, I'll still give this a try. It's worth it even just to verify that I haven't missed anything. Thanks for…",[87],{"value":88,"source":73,"evidence":89},"Project-level config files were not found in one tester's run",[90],{"id":91,"by":92,"text":93},"48368057","drcongo","I tried this out after finding it on one of your comments yesterday, the good: it set some values in global config files for me which was handy, the not so good: I still haven't…",[95],{"value":96,"source":45,"evidence":97},"Clearer and easier usage, as the maker acknowledged",[98],{"id":99,"by":11,"text":100},"48369797","Thanks for using it and thanks for the feedback! Would you mind opening an issue here with the steps you did (including OS \u002F method of installing) I’ll do my best to fix it.…",[],[103],{"value":104,"source":45,"evidence":105},"cooldowns.dev, which covers cooldowns across more ecosystems with a shell helper",[106],{"id":48},{"comments":108,"answered":34,"key":109},4,[110,113,114],{"id":111,"text":112},"48379643","Thank you so much for writing this!",{"id":99,"text":100},{"id":115,"text":116},"48549735","Should be fixed now, thanks again!",{"commenters":108,"max_depth":32,"maker_replies":108,"first_comment_mins":118,"lifespan_hours":119},1013,345,[121,123,125,127,129,130,131],[83,33,40,122,84,33],"project\u002Fpositive\u002Fidea",[111,33,33,124,11,34],"maker\u002Fneutral\u002Fnone",[91,34,35,126,92,33],"project\u002Fmixed\u002Fexecution",[99,34,33,128,11,34],"maker\u002Fneutral\u002Fexecution",[115,34,33,128,11,34],[76,32,40,122,77,33],[132,32,33,124,11,34],"48379644",[],[135,140,144,148,153,158],{"id":136,"name":137,"points":138,"category":139},"48304260","Hallucinate",442,"games",{"id":141,"name":142,"points":143,"category":139},"48308376","Continue? Y\u002FN",386,{"id":145,"name":146,"points":147,"category":139},"48367723","Eyeball",295,{"id":149,"name":150,"points":151,"category":152},"48374552","Edsger",264,"dev_tools",{"id":154,"name":155,"points":156,"category":157},"48344327","Test-Drive-3-Maps",215,"learning_science",{"id":159,"name":160,"points":161,"category":162},"48328184","Tiny-vLLM",205,"ai",false,"v2",{"id":166,"name":5,"line":6,"ai":163,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":30,"top":18,"kw":167,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":168,"url":9,"mix":169,"praise":72,"objection":88,"sub":21},48359478,[24,25,26,27,28],"5030050",[32,33,34,33],1793991155580]