pmsec

library0.13.0jsnpmunverified

Zero-config install-time supply-chain hardening for multiple package managers including npm, pnpm, yarn, bun, cargo, mise, uv, and bundler. Current stable version 0.13.0, active development with no fixed release cadence. Differentiators: single-command setup, supports eight package managers, enforces cooldown, signature trust, lockfile re-verification, build-script attestation, and monotonic cooldown enforcement. Requires Node 22+, ESM only, zero runtime dependencies.

security

npm install pmsec

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · PMSEC

pmsec

securityjavascriptv0.13.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ npx pmsec

pmsec is a CLI tool intended to be run via npx or uvx; there is no programmatic API or importable module.

Runs pmsec with default settings to harden all supported package managers' configs (1-day cooldown, trust policies, lockfile verification).

npx pmsec

Debug

Known issues

breakingRequires Node.js version 22 or higher (engines.node >=22). Running on older versions will fail with a runtime error.

fix

Upgrade Node.js to version >=22.

affects: <22

gotchapmsec is ESM-only and must be invoked via npx or uvx; it cannot be required or imported as a CommonJS module.

fix

Use 'npx pmsec' or 'uvx pmsec' to run.

affects: all

gotchaWhen target config files are owned by another user (e.g., ~/.npmrc left root-owned by sudo npm config set), pmsec fails with EACCES and suggests a chown command; it never escalates privileges.

fix

Run the suggested chown command or adjust file ownership manually before re-running pmsec.

affects: all

deprecatedNo deprecated features currently; initial release series (0.x) may introduce breaking changes without major version bump.

fix

Pin to a specific version and test upgrades.

affects: all

Errors

Common errors & fixes

Error: Dynamic require of "pmsec" is not supported. Did you mean to run "npx pmsec"?

Attempting to require() the ESM-only CLI tool or import it as a module.

fix

Use 'npx pmsec' instead of any require() or import statement.

EACCES: permission denied, open '/home/user/.npmrc'

pmsec cannot write to a config file owned by another user, typically root from a previous sudo npm config set command.

fix

Run the chown command printed by pmsec, or manually chown the file to your user, then re-run pmsec.

Error: Cannot find module 'npx' or command not found: npx

npx is not installed or Node.js is not in PATH.

fix

Install Node.js (>=22) from https://nodejs.org or via a version manager like nvm, ensuring npx is available.

Upgrade

Version history

0.13.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

10 hits · last 30 days

node

Resources

githubhttps://github.com/HikaruEgashira/pmsec ↗

packagepmsec ↗

homepagehttps://github.com/HikaruEgashira/pmsec#readme ↗