automation

safe-chain: Protect Code

Name: safe-chain: Protect Code
Author: AikidoSec

Prevent malicious code installs with safe-chain, for founders using npm, yarn and more, backed by 1.6k+ GitHub stars

intermediate⏱ 30 minutes💵 Free

1,627 stars104 forksJavaScriptHealth Score 9/10Updated 7/29/2026100% free · open source

What it is

Prevent malicious code from being installed on your project with safe-chain.

What you can make with it

Automations to ensure that your open-source dependencies are safe, such as verifying npm packages before adding them to your project.

How it helps

Using safe-chain helps you avoid potential security risks and maintain a clean project environment by automatically checking packages for malicious code.

Real use case example

"A founder, Sarah, wants to ensure her open-source project uses safe and trusted packages. She sets up safe-chain in her project's npm scripts and runs it before adding any new dependencies. Safe-chain scans the packages and alerts her to potential security risks, allowing her to make informed decisions about which packages to use."

If you're new

Beginners can start using safe-chain as a way to learn about project security and best practices.

If you're senior

Senior developers and founders use safe-chain for its robust package security checks and to maintain a clean and secure project environment.

Common confusion cleared up

You might think safe-chain is only for projects with sensitive data, but it can be used to maintain project security for any open-source project.

Best inside these AI tools

Self-hosted

Pairs with

npmyarnpnpmnpx

Why we list it on WorkflowStacks: A marketplace of AI tools includes this to provide free and open-source security features that save time and cost compared to using paid alternative solutions.

What it does

Safe-chain prevents malicious code installs by verifying the integrity of packages installed via npm, yarn, pnpm, npx, pnpx, pip, uv, and poetry

Install / run

npx @aikidosec/safe-chain init

When to use it

•When using npm or yarn to install dependencies for your project
•When running scripts with npx or pnpx that may install unknown code
•When managing dependencies with pip, uv, or poetry and want to ensure safety

Quick start

1Run 'npx @aikidosec/safe-chain init' to initialize safe-chain in your project
2Configure your package manager to use safe-chain by adding the '--safe-chain' flag to your install commands
3Verify the integrity of your installed packages with 'npx @aikidosec/safe-chain verify'
4Integrate safe-chain into your CI/CD pipeline to automate security checks
5Refer to the GitHub repository for advanced configuration options and troubleshooting guides

Ready-to-paste prompt

npx @aikidosec/safe-chain verify --package-manager npm --lock-file package-lock.json

Heads up: Make sure you have the necessary permissions and access rights to execute the safe-chain commands, as some features may require elevated privileges or specific environment variables to be set

Saves to your device

How safe-chain: Protect Code works

Codeflow

Free to inspect

Safe-chain: Protect Code is a large JavaScript project (~20k lines across 179 code files, plus 28 test files). Setup is light: installs like a normal app. Reading the code is optional. Last commit this month, Other license, has a test suite.

Size

Large codebase

~20k lines · 179 code files · ~3 h to skim

Setup

One-command install

Installs like a normal app. Reading the code is optional.

Runs on

Node.js

No API keys detected

JavaScript 90%Shell 6%PowerShell 4%

Where to start reading