Safer-Dependencies for Claude Code

When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo away from a malicious lookalike.

safer-dependencies is a security layer for Claude Code: it sits between Claude and your manifest files and runs its security checks automatically: vulnerable installs are denied before they run, and a risky version written to a manifest is corrected on disk right after the write. It detects and fixes risky dependencies — CVEs, typosquats, abandoned packages, and version-age issues, plus a cooldown period on brand-new releases — across npm, PyPI, RubyGems, Maven, Go, Rust, and PHP (Composer)

When Claude is about to add a package to your project, safer-dependencies intercepts and runs 5 checks:

1. Provenance — official registry, typosquat detection (npm/PyPI/RubyGems/Maven/crates.io), package age
2. Version age — picks the newest stable version published 7+ days ago (cooldown window)
3. Vulnerability scan — OSV API, with ecosystem-native tools (npm audit, pip-audit, bundle audit) when available
4. Hash-pin integrity — for PyPI requirements.txt lines with --hash=sha256:... pins, the declared hash is validated against PyPI’s published hashes; mismatch emits a WARNING
5. Abandoned & stale packages — known-abandoned packages (e.g. paperclip, request, pycrypto, github.com/dgrijalva/jwt-go) are hard-blocked immediately with a suggested replacement; packages with no stable release in 2+ years get an advisory STALE: warning. Hard-blocked packages are removed from the manifest and Claude will ask how to proceed; stale-only packages are left in place.

Link: https://github.com/robert-auger/safer-dependencies