This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
DepSentinel
Block malicious dependencies before they reach your machine
Blocks malicious packages, typosquatting and vulnerable dependencies before they reach your machine or production. Scans npm, PyPI, Go, Docker and GitHub Actions in seconds, 100% local, no account, no telemetry. Free and open source (MIT). Runs in CI and comments on pull requests. Includes a preventive guard: `depsentinel guard npm install` generates the lockfile with --ignore-scripts, scans it, and only then installs.
Hi Product Hunt! 👋
I built DepSentinel after a routine `npm install` pulled in over a thousand packages I had never read. Most of them transitive, some with install scripts, none reviewed. Supply-chain attacks (event-stream, ua-parser-js, colors.js…) keep happening and `npm audit` runs after the damage is already installed.
DepSentinel scans your lockfiles before anything runs: malicious packages, typosquats, suspicious install scripts, known CVEs, unpinned GitHub Actions and unpinned Docker images. It runs fully on your machine, no account, no telemetry, no server of ours.
The feature I'm most proud of is `depsentinel guard npm install`: it generates the lockfile with --ignore-scripts (so no install script runs), scans it, and only then runs the real install. That closes the window where a normal `npm install` already executed attacker code.
It's free, MIT-licensed and works in CI with a single `--ci --fail-on high`. Would love your feedback, especially false positives — there's a template for that.
Thanks for checking it out! 🛡️
No comment highlights available yet. Please check back later!
About DepSentinel on Product Hunt
“Block malicious dependencies before they reach your machine”
DepSentinel was submitted on Product Hunt and earned 3 upvotes and 1 comments, placing #95 on the daily leaderboard. Blocks malicious packages, typosquatting and vulnerable dependencies before they reach your machine or production. Scans npm, PyPI, Go, Docker and GitHub Actions in seconds, 100% local, no account, no telemetry. Free and open source (MIT). Runs in CI and comments on pull requests. Includes a preventive guard: `depsentinel guard npm install` generates the lockfile with --ignore-scripts, scans it, and only then installs.
DepSentinel was featured in Open Source (69k followers), Developer Tools (521.6k followers), GitHub (41.4k followers) and Security (3k followers) on Product Hunt. Together, these topics include over 145.4k products, making this a competitive space to launch in.
Who hunted DepSentinel?
DepSentinel was hunted by AlejandroMolines. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how DepSentinel stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
AlejandroMolines