How aikidosec/safe-chain works
Safe Chain wraps package-manager commands, optionally pre-scans requested dependencies, and routes registry traffic through a local security proxy. The proxy checks malware intelligence and enforces minimum package age; shell integration installs command wrappers. The README documents npm/PyPI protection, package-manager support, and safe-patch age exemptions. Unsampled wiring is represented only where documented; package-manager and interceptor internals are grouped at their supported source paths.
Main entry points: main.js Safe Chain runtime · currentPackageManager.js Manager dispatch · minimumPackageAgeChecker.js Minimum age checks · registryProxy.js Local registry proxy
Components 25
Command handling
- Command shim
packages/safe-chain/bin/safe-chain.js - Safe Chain runtime
packages/safe-chain/src/main.js - Manager dispatch
packages/safe-chain/src/packagemanager/currentPackageManager.js - npm-family managers
packages/safe-chain/src/packagemanager/npm/createPackageManager.js - Python managers
packages/safe-chain/src/packagemanager/pip/createPackageManager.js - Other managers
packages/safe-chain/src/packagemanager - Runtime settings
packages/safe-chain/src/config/settings.js
Package security
- Command scanning
packages/safe-chain/src/scanning/index.js - Dependency audit
packages/safe-chain/src/scanning/audit/index.js - Malware intelligence
packages/safe-chain/src/scanning/malwareDatabase.js - Threat list cache
packages/safe-chain/src/scanning/remoteListCache.js - Safe patch exemptions
packages/safe-chain/src/scanning/safePatchesListCache.js - New package cache
packages/safe-chain/src/scanning/newPackagesListCache.js
Registry proxy
- Local registry proxy
packages/safe-chain/src/registryProxy/registryProxy.js - Request handling
packages/safe-chain/src/registryProxy/mitmRequestHandler.js - Registry interceptors
packages/safe-chain/src/registryProxy/interceptors/createInterceptorForEcoSystem.js - npm interceptor
packages/safe-chain/src/registryProxy/interceptors/npm/npmInterceptor.js - PyPI interceptor
packages/safe-chain/src/registryProxy/interceptors/pip/pipInterceptor.js - Minimum age checks
packages/safe-chain/src/registryProxy/interceptors/minimumPackageAgeChecker.js
Shell integration
- Shell setup
packages/safe-chain/src/shell-integration/setup.js - Shell wrappers
packages/safe-chain/src/shell-integration/supported-shells
Other components
- Developer or CI
- npm registry
- PyPI registry
- Aikido Intel
Connections 28
- Developer or CI → Command shim: runs command
- Command shim → Safe Chain runtime: starts runtime
- Safe Chain runtime → Manager dispatch: gets manager
- Manager dispatch → npm-family managers: selects
- Manager dispatch → Python managers: selects
- Manager dispatch → Other managers: selects
- Safe Chain runtime → Command scanning: scans command
- Command scanning → Dependency audit: audits packages
- Dependency audit → Malware intelligence: checks threats
- Malware intelligence → Threat list cache: uses cached list
- Safe Chain runtime → Local registry proxy: starts proxy
- npm-family managers → Local registry proxy: sets proxy environment
- Python managers → Local registry proxy: sets proxy environment
- Local registry proxy → Request handling: handles requests
- Request handling → Registry interceptors: dispatches by ecosystem
- Registry interceptors → npm interceptor: selects npm
- Registry interceptors → PyPI interceptor: selects PyPI
- npm interceptor → npm registry: forwards requests
- PyPI interceptor → PyPI registry: forwards requests
- npm interceptor → Minimum age checks: checks release age
- PyPI interceptor → Minimum age checks: checks release age
- Minimum age checks → New package cache: checks cached releases
- Minimum age checks → Safe patch exemptions: allows safe patches
- Malware intelligence → Aikido Intel: refreshes threat data
- Developer or CI → Shell setup: configures shell
- Shell setup → Shell wrappers: installs wrappers
- Shell wrappers → Command shim: wraps commands
- Safe Chain runtime → Runtime settings: reads configuration