{"id":45795,"library":"pmsec","title":"pmsec","description":"Zero-config install-time supply-chain hardening for multiple package managers including npm, pnpm, yarn, bun, cargo, mise, uv, and bundler. Current stable version 0.13.0, active development with no fixed release cadence. Differentiators: single-command setup, supports eight package managers, enforces cooldown, signature trust, lockfile re-verification, build-script attestation, and monotonic cooldown enforcement. Requires Node 22+, ESM only, zero runtime dependencies.","status":"active","version":"0.13.0","language":"javascript","source_language":"en","source_url":"https://github.com/HikaruEgashira/pmsec","tags":["javascript","supply-chain","cooldown","min-release-age","exclude-newer","npm","pnpm","yarn","bun"],"install":[{"cmd":"npm install pmsec","lang":"bash","label":"npm"},{"cmd":"yarn add pmsec","lang":"bash","label":"yarn"},{"cmd":"pnpm add pmsec","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"pmsec is a CLI tool intended to be run via npx or uvx; there is no programmatic API or importable module.","symbol":"default","correct":"npx pmsec"}],"quickstart":{"code":"npx pmsec","lang":"javascript","description":"Runs pmsec with default settings to harden all supported package managers' configs (1-day cooldown, trust policies, lockfile verification)."},"warnings":[{"fix":"Upgrade Node.js to version >=22.","message":"Requires Node.js version 22 or higher (engines.node >=22). Running on older versions will fail with a runtime error.","severity":"breaking","affected_versions":"<22"},{"fix":"Use 'npx pmsec' or 'uvx pmsec' to run.","message":"pmsec is ESM-only and must be invoked via npx or uvx; it cannot be required or imported as a CommonJS module.","severity":"gotcha","affected_versions":"all"},{"fix":"Run the suggested chown command or adjust file ownership manually before re-running pmsec.","message":"When target config files are owned by another user (e.g., ~/.npmrc left root-owned by sudo npm config set), pmsec fails with EACCES and suggests a chown command; it never escalates privileges.","severity":"gotcha","affected_versions":"all"},{"fix":"Pin to a specific version and test upgrades.","message":"No deprecated features currently; initial release series (0.x) may introduce breaking changes without major version bump.","severity":"deprecated","affected_versions":"all"}],"env_vars":null,"search_vec":"'0.13.0':29 '22':64 'activ':30 'age':78 'attest':57 'build':55 'build-script':54 'bun':20,85 'bundler':25 'cadenc':36 'cargo':21 'chain':10,73 'command':40 'config':4 'cooldown':47,60,74 'current':26 'depend':69 'develop':31 'differenti':37 'eight':43 'enforc':46,61 'esm':65 'exclud':80 'exclude-new':79 'fix':34 'harden':11 'includ':16 'instal':6 'install-tim':5 'javascript':70 'lockfil':50 'manag':15,45 'min':76 'min-release-ag':75 'mise':22 'monoton':59 'multipl':13 'newer':81 'node':63 'npm':17,82 'packag':14,44 'pmsec':1 'pnpm':18,83 're':52 're-verif':51 'releas':35,77 'requir':62 'runtim':68 'script':56 'setup':41 'signatur':48 'singl':39 'single-command':38 'stabl':27 'suppli':9,72 'supply-chain':8,71 'support':42 'time':7 'trust':49 'uv':23 'verif':53 'version':28 'yarn':19,84 'zero':3,67 'zero-config':2","created_at":"2026-06-07T12:56:46.041594+00:00","updated_at":"2026-06-07T12:56:46.041594+00:00","problems":[{"fix":"Use 'npx pmsec' instead of any require() or import statement.","cause":"Attempting to require() the ESM-only CLI tool or import it as a module.","error":"Error: Dynamic require of \"pmsec\" is not supported. Did you mean to run \"npx pmsec\"?"},{"fix":"Run the chown command printed by pmsec, or manually chown the file to your user, then re-run pmsec.","cause":"pmsec cannot write to a config file owned by another user, typically root from a previous sudo npm config set command.","error":"EACCES: permission denied, open '/home/user/.npmrc'"},{"fix":"Install Node.js (>=22) from https://nodejs.org or via a version manager like nvm, ensuring npx is available.","cause":"npx is not installed or Node.js is not in PATH.","error":"Error: Cannot find module 'npx' or command not found: npx"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/HikaruEgashira/pmsec#readme","github":"https://github.com/HikaruEgashira/pmsec","docs":null,"changelog":null,"pypi":null,"npm":"pmsec","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-07","next_check":"2026-09-05","install_tag":null}}