Audit every package manager in the tree.
Finds each package-manager root, reads committed settings, and runs that manager's own audit.
$brew install jackmcpickle/pkguard/pkguard
$pkguard scan ~/code
Settings first. Advisories second.
Find each root
Walk the path you pass and stop at every package-manager root.
Read committed settings
Parse the config files in git. A missing binary does not skip this.
Run the native audit
If the manager binary is on PATH, pkguard shells out to that manager's own audit command.
JavaScript, Python, Rust, PHP, Ruby.
The package managers pkguard looks for under each root.
JavaScript
- npm
- pnpm
- yarn
- bun
Python
- uv
- poetry
- pip
- pipenv
Rust
- cargo
PHP
- composer
Ruby
- bundler
Live settings checks and native audit: npm, pnpm, yarn, bun, uv, cargo, composer, bundler. Detected only: poetry, pip, pipenv.Manager profiles
Install with Homebrew
macOS and Linux. Cargo works if you already have a Rust toolchain.
$brew install jackmcpickle/pkguard/pkguard