automation

safe-chain: Protect Code

Name: safe-chain: Protect Code
Author: AikidoSec

Prevent malicious code installs with safe-chain, for founders using npm, yarn and more, backed by 1.6k+ GitHub stars

From the repo · “Protect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.”

intermediate⏱ 30 minutes💵 Free

1,828 stars+28★ this week119 forksJavaScriptGuide quality 9/10 · reviewed Jul 2Updated 10/24/2026100% free · open source

What it is

Prevent malicious code from being installed on your project with safe-chain.

Real use case example

"A founder, Sarah, wants to ensure her open-source project uses safe and trusted packages. She sets up safe-chain in her project's npm scripts and runs it before adding any new dependencies. Safe-chain scans the packages and alerts her to potential security risks, allowing her to make informed decisions about which packages to use."

Best insideSelf-hosted

When to use it

•When using npm or yarn to install dependencies for your project
•When running scripts with npx or pnpx that may install unknown code
•When managing dependencies with pip, uv, or poetry and want to ensure safety

Ready-to-paste prompt

npx @aikidosec/safe-chain verify --package-manager npm --lock-file package-lock.json

Heads up: Make sure you have the necessary permissions and access rights to execute the safe-chain commands, as some features may require elevated privileges or specific environment variables to be set

Saves to your device

Use with Claude

New

Skip the builder — one click puts this in Claude, Cursor, Antigravity and more.

✅ Light setup

Installs with a command or two; your AI agent can do it for you.

Try it instantly — no install

Claude Code

mkdir -p ~/.claude/skills/safe-chain && curl -fsSL https://workflowstacks.com/api/skills/safe-chain/claude-skill -o ~/.claude/skills/safe-chain/SKILL.md

Open in another AI app

Opens the app with this repo with the prompt ready to go — no copy-paste needed.

Connect the whole catalog (MCP)

claude mcp add --transport http workflowstacks https://workflowstacks.com/api/mcp

Adds a WorkflowStacks connector to Claude Code: search and load any skill here by chatting.

How safe-chain: Protect Code works

Codeflow

Free to inspect

Safe-chain: Protect Code is a large JavaScript project (~27k lines across 198 code files, plus 29 test files). Setup is light: installs like a normal app. Reading the code is optional. Last commit this month, Other license, has a test suite.

Size

Large codebase

~27k lines · 198 code files · ~4 h to skim

Setup

One-command install

Installs like a normal app. Reading the code is optional.

Runs on

Node.js

No API keys detected

JavaScript 91%Shell 5%PowerShell 4%

Where to start reading

1
README.md
Start here — what it does and how to install it
2
package.json
Dependencies and the commands it exposes

What's in each folder

packages/Sub-packages / plugins190 files

docs/Documentation6 files

install-scripts/Folder12 files

test/Tests — proof it works31 files

.github/CI / automation (GitHub Actions)6 files

READMEHas testsDocumentedCI checksOther licenseUpdated this month

Use with Claude

New

Skip the builder — one click puts this in Claude, Cursor, Antigravity and more.

✅ Light setup

Installs with a command or two; your AI agent can do it for you.

Try it instantly — no install

Claude Code

mkdir -p ~/.claude/skills/safe-chain && curl -fsSL https://workflowstacks.com/api/skills/safe-chain/claude-skill -o ~/.claude/skills/safe-chain/SKILL.md

Open in another AI app

Opens the app with this repo with the prompt ready to go — no copy-paste needed.

Connect the whole catalog (MCP)

claude mcp add --transport http workflowstacks https://workflowstacks.com/api/mcp

Adds a WorkflowStacks connector to Claude Code: search and load any skill here by chatting.

Quick Actions

Details

Creator

AikidoSec

Language

JavaScript