depsguard

depsguard [scan|restore] [options]

depsguard is a Rust CLI that audits JavaScript and Python package manager configuration files for supply-chain hardening settings and applies missing protections after explicit user approval.It inspects user-level files such as `~/.npmrc`, `~/.yarnrc.yml`, `~/.bunfig.toml` and `uv.toml`, and repository-level files including `package.json`, lockfiles, Renovate config and Dependabot config. It checks for settings like minimum release age (delaying installation of newly published versions), blocking install scripts, restricting exotic transitive dependencies, trust policies, and strict build requirements.In its default interactive mode depsguard presents detected issues in a TUI, lets the user select which fixes to apply, and writes timestamped backups under `~/.depsguard/backups/` before modifying any file. The `restore` subcommand replays a chosen backup.The tool itself never installs packages and ships with zero third-party crate dependencies.

scan

Read-only report. Does not modify any files.

Recover configuration from a timestamped backup.

Check only local config files in the current directory. Skip recursive discovery.

Show CLI documentation.

Backups are written to `~/.depsguard/backups/` before each apply operation.

Some hardening options require recent package manager versions (for example npm 11.10 or newer for certain flags). A VT-capable terminal is recommended for proper TUI rendering. Building from source requires Rust 1.74 or newer.

npm(1), pnpm(1), yarn(1), bun(1), uv(1)