pmsec 0.4.1

Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun, cargo, mise, and uv.

pmsec (Python)

pmsec is a cross-platform CLI that inspects and applies install-time cooldown settings (e.g. npm min-release-age, uv exclude-newer) to mitigate supply-chain attacks where malicious packages are typically detected and removed within hours to days of publication.

Install

uvx pmsec check --min 7
uvx pmsec set 7
uvx pmsec unset

npx pmsec check --min 7
npx pmsec set 7
npx pmsec unset

If your environment already enforces cooldown (or routes through a proxy index), bootstrap pmsec by overriding just for that call:

uvx --index https://pypi.org/simple --exclude-newer-package pmsec=2099-01-01 pmsec check
npx --registry=https://registry.npmjs.org/ --min-release-age=0 pmsec check

Supported tools

npm, pnpm, yarn 4+, bun, cargo (RFC #3801), mise, uv

Commands

Command	Description
pmsec check [--min N]	Read each tool's config; exit 1 if any tool is below N days or unset
pmsec set <DAYS>	Write DAYS-day cooldown to every selected tool
pmsec unset	Remove only the cooldown key from each config (other keys preserved)
pmsec --version	Print the installed pmsec version

Options: --tool npm,pnpm,yarn,bun,cargo,mise,uv, --json.

See the project README for the full table of keys, units, paths, and overrides.

License

MIT