DepsGuard

DepsGuard is a command-line tool for checking package-manager configuration settings tied to software supply chain security. It scans npm, pnpm, yarn, bun, aube, uv, pip, and poetry configs and helps apply security best practices to guard dependencies against supply chain attacks.

Running depsguard in a terminal launches an interactive TUI that shows a table of findings. The interface supports moving through results, toggling individual fixes, bulk-selecting by file type, filtering to selected fixes, and previewing changes with a diff before anything is committed. It also supports repo-level config discovery from the current directory downward, a read-only scan mode, and a no-search mode that checks only user-level configs. After fixes are applied, it rescans automatically, and a restore command can roll back from the backup list. The documented settings include delaying adoption of new versions, blocking malicious install scripts, blocking untrusted transitive dependencies, enforcing provenance-related policy, and failing on unreviewed build scripts, subject to package-manager and version support.

The tool is available on macOS, Linux, and Windows, with installation paths shown for Homebrew, APT, WinGet, Scoop, Cargo, and direct binaries. The page also states that it has zero dependencies and is distributed under the MIT license. Its install instructions note a Rust toolchain requirement for the Cargo path.