pkguard
Menu
Docs About GitHub

Audit every package manager in the tree.

pkguard is a free command-line tool. It scans a folder full of repos. It finds every package manager, reads the settings you keep in git, and runs each manager's own audit. One command covers npm, pnpm, yarn, bun, uv, cargo, composer, and bundler.

A scan never writes files. Add --fix when you want it to repair the unsafe settings it finds.

$ brew install jackmcpickle/pkguard/pkguard
$ pkguard scan ~/code
A dark metal tree with orange electric veins and packages hanging from the branches.

Settings first. Advisories second.

  1. Find each root

    Walk the path you pass and stop at every package-manager root.

  2. Read committed settings

    Parse the config files in git. A missing binary does not skip this.

  3. Run the native audit

    If the manager binary is on PATH, pkguard shells out to that manager's own audit command.

What a run looks like.

A real scan of one folder holding a bun app and a uv service. Settings come first, then the advisories from each manager's own audit. The last line is the whole run.

$ pkguard scan ~/code

react-project 37 findings

preset standard

bun · settings (3)

  • high min-age.disabled install.minimumReleaseAge must be at least 86400 seconds
  • high scripts.unrestricted bun scripts must be restricted
  • info registry.unpinned install.registry must be set

bun · advisories (34)

  • critical GHSA-w7jw-789q-3m8p shell-quote · shell-quote quote() does not escape newlines in object .op values
  • high GHSA-4cwx-7wf7-3272 undici · cross-user information disclosure and parse-time crash via degenerate private cache directives
  • high GHSA-fx2h-pf6j-xcff vite · server.fs.deny bypass on Windows alternate paths
  • moderate GHSA-58qx-3vcg-4xpx ws · uninitialized memory disclosure
  • and 30 more advisories

python-project 49 findings

preset standard

uv · settings (2)

  • high audit.malware-disabled uv audit malware-check must be true
  • high min-age.disabled exclude-newer must meet 1 days

uv · advisories (47)

  • info GHSA-34jh-p97f-mpxf [email protected] -> 1.26.19 · urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
  • info GHSA-3f63-hfp8-52jq [email protected] -> 10.2.0 · Arbitrary Code Execution in Pillow
  • info GHSA-3ww4-gg4f-jr7f [email protected] -> 42.0.0 · Python Cryptography package vulnerable to Bleichenbacher timing oracle attack
  • info GHSA-44wm-f244-xhp3 [email protected] -> 10.3.0 · Pillow buffer overflow vulnerability
  • and 43 more advisories

2 projects · 1 critical, 21 high, 13 moderate, 3 low, 48 info · policy failed · exit 1

Exit 1 means a policy failure. See the scan docs for every exit code. The uv rows all read info because uv publishes no severity with an advisory.

JavaScript, Python, Rust, PHP, Ruby.

The package managers pkguard looks for under each root.

  • JavaScript

    • npm
    • pnpm
    • yarn
    • bun

  • Python

    • uv
    • poetry
    • pip
    • pipenv

  • Rust

    • cargo

  • PHP

    • composer

  • Ruby

    • bundler

Live settings checks and native audit: npm, pnpm, yarn, bun, uv, cargo, composer, bundler. Detected only: poetry, pip, pipenv. Manager profiles

pkguard --help

Questions and answers.

The short answers. The docs go deeper.

What is pkguard?

pkguard is a command-line tool that audits every package manager in a folder of repos. It reads the settings you keep in git, then runs each manager's own audit command. You get one report instead of twenty.

Is it safe to run?

Yes. A plain scan only reads files. pkguard writes nothing unless you pass --fix, and --fix stops on a dirty git tree unless you add --force. Use --fix --dry-run to see the changes first.

What does it cost?

Nothing. pkguard is free and open source under the MIT license. There is no paid tier, no account, and no telemetry.

Can it run offline?

Yes. Pass --no-audit to skip every live audit. The settings checks still run, because they only read files on your disk.

Which package managers does it support?

npm, pnpm, yarn, bun, uv, cargo, composer, and bundler get full settings checks and a native audit. poetry, pip, and pipenv are detected but not yet fully checked.

How do I use it in CI?

Run pkguard scan . --preset strict --format json. The JSON output is meant for machines, and the exit code is non-zero when a check fails.

Who maintains pkguard?

Jack McNicol (https://github.com/jackmcpickle). Bugs and questions go to https://github.com/jackmcpickle/pkguard/issues.

Where are the release notes?

Every version is listed on the GitHub releases page and in CHANGELOG.md in the repo. The version shown on this site comes straight from the binary.

Dark anodized metal plate with one orange hex screw in raking light.

Install with Homebrew

macOS and Linux. Cargo works if you already have a Rust toolchain.

$ brew install jackmcpickle/pkguard/pkguard
Install guide Releases