About pkguard
pkguard is a free, open-source command-line tool. It audits every package manager in a folder of repos. It reads the settings you keep in git, then runs each manager's own audit. You get one report instead of one per project.
Last updated . Current version 1.0.3.
Why it exists
Most audit tools work on one project at a time. If you keep twenty repos in one folder, you have to open each one and run its own audit by hand. Some use npm, some use uv, some use cargo. pkguard walks the folder once and reports on all of them.
It also checks the config files that live in git. Those files decide whether install scripts run, whether a lockfile is required, and where the cache sits. A bad setting is a risk even when no advisory exists. So pkguard checks settings first and advisories second.
Who builds it
pkguard is written and maintained byJack McNicol. It is not a company product. Work happens in the open on GitHub, and pull requests are welcome.
Price and licence
pkguard is free. There is no paid tier, no account, and no telemetry. It is released under theMIT license, so you can use it at work, fork it, and ship it inside your own tools.
Your data
pkguard runs on your machine. It does not upload your code, your lockfiles, or your config. The only network traffic comes from the package managers themselves when they fetch advisories, and --no-audit turns that off. This website sets no cookies and runs no analytics.
Contact
The fastest way to reach the project is GitHub.
- Bugs and feature requestsGitHub issues
- QuestionsGitHub discussions
- Source codehttps://github.com/jackmcpickle/pkguard
- MaintainerJack McNicol
Releases
Every version is tagged on GitHub. Read therelease notesor the fullchangelog.