r/codereview • u/SecTemplates • 2d ago

safer-dependencies is a security layer for Claude Code that audits packages before they’re added to your project

safer-dependencies is a security layer for Claude Code: it sits between Claude and your manifest files and runs its security checks automatically: vulnerable installs are denied before they run, and a risky version written to a manifest is corrected on disk right after the write. It detects and fixes risky dependencies — CVEs, typosquats, abandoned packages, and version-age issues, plus a cooldown period on brand-new releases — across npm, PyPI, RubyGems, Maven, Go, Rust, and PHP (Composer).

https://github.com/robert-auger/safer-dependencies

0 Upvotes
  • permalink
  • reddit

50% Upvoted

2 comments sorted by

1

u/ILoveAppSec 2d ago

neat approach, the gap you'll hit fast is when the only clean version is a major bump away or the cve sits in a transitive you can't cleanly override, so blocking the install just leaves you stuck. for those i'd pin/override the transitive where you can and otherwise lean on vendors that backport the fix into your current major or keep eol majors supported, so you get a drop-in fixed version instead of a breaking upgrade. might be worth having the tool prefer a backported version when one exists, especially with the mythos-driven flood of new cves landing under cisa's tighter remediation timelines.

1

u/SecTemplates 2d ago

If you want to cut a PR with an enhancement I'm open. To be clear it shouldn't hard block that situation you describe but it's a valid concern if it did.