PkgFire

A dependency firewall for npm, pnpm, Bun and Go modules. It checks what an install would do before anything runs.

Install

macOS and Linux, Intel or ARM 
curl -fsSL https://pkgfire.org/install.sh | sh

The script verifies every download against the published SHA256SUMS and refuses to install on a mismatch.

Piping a script into a shell to install a tool that exists to stop you running unchecked code is a fair thing to hesitate over. Read it first with curl -fsSL https://pkgfire.org/install.sh | less, or skip it and take a binary from /downloads/ by hand.

Then

  1. Create an API key under API keys.
  2. pkgfire auth set-key
  3. pkgfire scan . in any project.

Or wrap an install directly — arguments pass through untouched:

pkgfire npm install
pkgfire pnpm add lodash
pkgfire bun install --production
pkgfire go get github.com/example/foo@v1.2.3

Exit codes

On a block nothing is installed and no lifecycle script runs
0allow
1warn
2block
3error

Sign in to the dashboard