{"slug": "aikido-safe-chain", "name": "Aikido Safe Chain", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 6, "warners": 2, "score": 0.436, "rising": 0.35, "first": "2025-11-26", "latest": "2026-10-22", "why": "I use safechain for this, because there is always gonna be another package manager configured wrong.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 0, "compare": 1, "warn": 2}, "spark": [1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "I use safechain for this, because there is always gonna be another package manager configured wrong.", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/aikidosec/safe-chain", "official_url": "https://github.com/AikidoSec/safe-chain", "pricing": "", "aliases": ["Aikido Safe Chain", "safe-chain", "Aikido Safe-Chain"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 802969328, "item_id": 50185583, "url": "https://news.ycombinator.com/item?id=50185583", "by": "sunbum", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "I use safechain for this, because there is always gonna be another package manager configured wrong.", "excerpt": "I use safechain for this, because there is always gonna be another package manager configured wrong. https://github.com/AikidoSec/safe-chain", "context": "", "use_case": "package install cooldown", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 761632000, "item_id": 47602000, "url": "https://news.ycombinator.com/item?id=47602000", "by": "kidk", "date": "2026-04-01", "version": null, "stance": "recommend", "quote": "Pretty cool it's free", "excerpt": "For people that don't use an MDM https://github.com/AikidoSec/safe-chain Pretty cool it's free", "context": "", "use_case": "", "switched_from": "", "story": "Deploy Aikido Safe-Chain via Iru (Kandji) or Jamf"}, {"id": 736914785, "item_id": 46057174, "url": "https://news.ycombinator.com/item?id=46057174", "by": "nycalexander", "date": "2025-11-26", "version": null, "stance": "recommend", "quote": "using Aikido's safe guard for npm, pnpm, bun, and yarn", "excerpt": "Made a package (that I needed personally), to easily reinstall all dependencies in a project using Aikido's safe guard for npm, pnpm, bun, and yarn. https://www.npmjs.com/package/eazypm", "context": "", "use_case": "safe package installs", "switched_from": "", "story": "Malware in PostHog NPM packages"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 803127120, "item_id": 50195445, "url": "https://news.ycombinator.com/item?id=50195445", "by": "mstaoru", "date": "2026-10-22", "version": null, "stance": "warn", "quote": "It's just next level:", "excerpt": "It's just next level: \"Installing the Aikido Safe Chain is easy with the installation script. curl -fsSL https://github.com/AikidoSec/safe-chain/releases/download/1.5.26/install-safe-chain.sh -o /tmp/install-safe-chain.sh \\ && echo \"9e4af7107f06d9c0d758cb08fb36804c2af88e24972f3a9d3f8c2bd0ca002adf /tmp/install-safe-chain.sh\" | sha256sum -c - \\ && sh /tmp/install-safe-chain.sh \\ && rm /tmp/install-safe-chain.sh \" (face", "context": "", "use_case": "", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 758213264, "item_id": 47388329, "url": "https://news.ycombinator.com/item?id=47388329", "by": "abound", "date": "2026-03-15", "version": null, "stance": "warn", "quote": "I'm just not willing to install a big blob of JavaScript to look for vulns", "excerpt": "Yeah it would have been nice to end with \"and here's a five-line shell script to check if your project is likely affected\". But to their credit, they do have an open-source tool [1], I'm just not willing to install a big blob of JavaScript to look for vulns in my other big blobs of JavaScript [1] https://github.com/AikidoSec/safe-chain", "context": "", "use_case": "", "switched_from": "", "story": "Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Repositories"}]}], "who": [], "tags": [], "use_cases": ["package install cooldown", "avoiding vulnerable dependencies", "malware check on dependencies", "malware checks for npm", "safe package installs"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50181114", "title": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48752948", "title": "Show HN: CLI that helps AI agents avoid vulnerable dependencies", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47592663", "title": "Deploy Aikido Safe-Chain via Iru (Kandji) or Jamf", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47387047", "title": "Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Repositories", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46046636", "title": "Big attack on NPM \u2013 Shai-Hulud 2.0", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46032539", "title": "Shai-Hulud Returns: Over 300 NPM Packages Infected", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {"warn": 1}, "2026-04": {"recommend": 1}, "2026-05": {}, "2026-06": {}, "2026-07": {"compare": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {"recommend": 1, "warn": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 803127120, "item_id": 50195445, "url": "https://news.ycombinator.com/item?id=50195445", "by": "mstaoru", "date": "2026-10-22", "version": null, "stance": "warn", "quote": "It's just next level:", "excerpt": "It's just next level: \"Installing the Aikido Safe Chain is easy with the installation script. curl -fsSL https://github.com/AikidoSec/safe-chain/releases/download/1.5.26/install-safe-chain.sh -o /tmp/install-safe-chain.sh \\ && echo \"9e4af7107f06d9c0d758cb08fb36804c2af88e24972f3a9d3f8c2bd0ca002adf /tmp/install-safe-chain.sh\" | sha256sum -c - \\ && sh /tmp/install-safe-chain.sh \\ && rm /tmp/install-safe-chain.sh \" (face", "context": "", "use_case": "", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 802969328, "item_id": 50185583, "url": "https://news.ycombinator.com/item?id=50185583", "by": "sunbum", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "I use safechain for this, because there is always gonna be another package manager configured wrong.", "excerpt": "I use safechain for this, because there is always gonna be another package manager configured wrong. https://github.com/AikidoSec/safe-chain", "context": "", "use_case": "package install cooldown", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 780394448, "item_id": 48774653, "url": "https://news.ycombinator.com/item?id=48774653", "by": "brianjking", "date": "2026-07-03", "version": null, "stance": "compare", "quote": "I use Aikido safe chain, how does this compare?", "excerpt": "I use Aikido safe chain, how does this compare? https://www.npmjs.com/package/@aikidosec/safe-chain", "context": "", "use_case": "avoiding vulnerable dependencies", "switched_from": "", "story": "Show HN: CLI that helps AI agents avoid vulnerable dependencies"}, {"id": 761632000, "item_id": 47602000, "url": "https://news.ycombinator.com/item?id=47602000", "by": "kidk", "date": "2026-04-01", "version": null, "stance": "recommend", "quote": "Pretty cool it's free", "excerpt": "For people that don't use an MDM https://github.com/AikidoSec/safe-chain Pretty cool it's free", "context": "", "use_case": "", "switched_from": "", "story": "Deploy Aikido Safe-Chain via Iru (Kandji) or Jamf"}, {"id": 758213264, "item_id": 47388329, "url": "https://news.ycombinator.com/item?id=47388329", "by": "abound", "date": "2026-03-15", "version": null, "stance": "warn", "quote": "I'm just not willing to install a big blob of JavaScript to look for vulns", "excerpt": "Yeah it would have been nice to end with \"and here's a five-line shell script to check if your project is likely affected\". But to their credit, they do have an open-source tool [1], I'm just not willing to install a big blob of JavaScript to look for vulns in my other big blobs of JavaScript [1] https://github.com/AikidoSec/safe-chain", "context": "", "use_case": "", "switched_from": "", "story": "Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Repositories"}, {"id": 736920657, "item_id": 46057541, "url": "https://news.ycombinator.com/item?id=46057541", "by": "nycalexander", "date": "2025-11-26", "version": null, "stance": "neutral", "quote": "check them using Aikido's safe chain for malware", "excerpt": "Made a package (that I needed personally), to easily reinstall all dependencies (using the same versions) in a project and check them using Aikido's safe chain for malware (supported npm, pnpm, bun, and yarn). It also easily switches a project's package manager to another. https://www.npmjs.com/package/eazypm", "context": "", "use_case": "malware check on dependencies", "switched_from": "", "story": "Big attack on NPM \u2013 Shai-Hulud 2.0"}, {"id": 736920465, "item_id": 46057529, "url": "https://news.ycombinator.com/item?id=46057529", "by": "nycalexander", "date": "2025-11-26", "version": null, "stance": "neutral", "quote": "check them using Aikido's safe chain for malware", "excerpt": "Made a package (that I needed personally), to easily reinstall all dependencies (using the same versions) in a project and check them using Aikido's safe chain for malware (supported npm, pnpm, bun, and yarn). It also easily switches a project's package manager to another. https://www.npmjs.com/package/eazypm", "context": "", "use_case": "malware checks for npm", "switched_from": "", "story": "Shai-Hulud Returns: Over 300 NPM Packages Infected"}, {"id": 736914785, "item_id": 46057174, "url": "https://news.ycombinator.com/item?id=46057174", "by": "nycalexander", "date": "2025-11-26", "version": null, "stance": "recommend", "quote": "using Aikido's safe guard for npm, pnpm, bun, and yarn", "excerpt": "Made a package (that I needed personally), to easily reinstall all dependencies in a project using Aikido's safe guard for npm, pnpm, bun, and yarn. https://www.npmjs.com/package/eazypm", "context": "", "use_case": "safe package installs", "switched_from": "", "story": "Malware in PostHog NPM packages"}]}