open-index/open-npm huggingface dataset:
npm package: @safedep/gryph
Description: AI coding agent audit trail tool
Author: SafeDep
Latest version: 0.6.0

# Gryph

**Gryph** is a local-first audit trail for AI coding agents. It hooks into your agents, logs every action to a local SQLite database, and gives you powerful querying capabilities to understand, review, and debug agent activity.

## Why Gryph?

- **Transparency** - See exactly what files were read, written, and what commands were run
- **Pre-commit review** - Verify agent changes before committing to git
- **Debugging** - Replay sessions to understand what went wrong
- **Privacy** - All data stays local. No cloud, no telemetry

## Installation

```bash
npm install -g @safedep/gryph
```

## Quick Start

```bash
# Install hooks for all detected agents
gryph install

# Verify installation
gryph status

# Start using your AI coding agent (Claude Code, Cursor, Gemini CLI, etc.)
# ...

# Review what happened
gryph logs
```


See more details at our [GitHub Project](https://github.com/safedep/gryph)
npm package: @safedep/pmg
Description: PMG protects developers from getting compromised by malicious packages
Author: SafeDep
Latest version: 0.6.0

# PMG - Package Manager Guard


🤖 PMG protects developers from getting compromised by malicious open source packages.

This is the npm distribution of PMG, a tool that wraps your favorite package manager (e.g., `npm`) and blocks malicious packages at install time.

## Installation

Install PMG globally via npm:

```bash
npm install -g @safedep/pmg
```

Or using Homebrew:

```bash
brew tap safedep/tap
brew install safedep/tap/pmg
```

## Usage

Set up PMG to automatically protect your package installations:

```bash
# Recommended: Set up automatic protection
pmg setup install
```

After setup, use your package managers normally:

```bash
# Your regular commands are now protected
npm install express
pnpm add react
pip install requests
```

Or use PMG manually without setup:

```bash
# Manual protection (alternative)
pmg npm install express
pmg pnpm add react
pmg pip install requests
```

## Platform Support

- ✅ **macOS** (Intel & Apple Silicon)
- ✅ **Linux** (x86_64, ARM64, i386)
- ✅ **Windows** (x86_64, ARM64, i386)

Requires Node.js 14 or higher.

---

For complete documentation, advanced usage, troubleshooting, and more information, please visit: **[github.com/safedep/pmg](https://github.com/safedep/pmg)**
npm package: @safedep/vet
Description: An open source software supply chain security tool built for developers and security engineers
Author: SafeDep
Latest version: 1.16.2

# 🔍 vet

Enterprise-grade open source software supply chain security in one CLI.

This package delivers the `vet` binary via npm for teams that prefer Node.js tooling for install & upgrades.


## ✨ What It Does

- Detects vulnerabilities (context & usage aware)
- Flags malicious / typosquatted packages (active + reputation)
- Enforces “Policy as Code” (licenses, popularity, scorecards) with CEL filters
- Works across ecosystems: npm, PyPI, Maven, Go, containers, SBOMs
- Outputs actionable reports: JSON, SARIF, Markdown, CycloneDX SBOM

## 📦 Install

```bash
npm install -g @safedep/vet
```

Or using Homebrew:

```bash
brew tap safedep/tap
brew install safedep/tap/vet
```

Check:
```bash
vet version
```

(Alternative installs: brew, direct binary, see upstream [README](https://github.com/safedep/vet/?tab=readme-ov-file#-vet))

## ⚡ Quick Start

```bash
# Scan current project (auto-detect lock/manifests)
vet scan -D .

# Scan a specific manifest
vet scan -M package-lock.json
```

## 🛡 Basic Policies

```bash
# Fail on critical vulns
vet scan -D . --filter 'vulns.critical.exists(p, true)' --filter-fail

# License guard (example)
vet scan -D . --filter 'licenses.contains_license("GPL-3.0")' --filter-fail

# Scorecard maintenance threshold
vet scan -D . --filter 'scorecard.scores.Maintained < 5' --filter-fail
```

## 🔬 Malware Detection

```bash
# Setup (get API key)
vet cloud quickstart

# Active malicious package analysis
vet scan -D . --malware

# Known-malicious lookup only (no key)
vet scan -D . --malware-query
```

## 📊 Reports

```bash
vet scan -D . \
  --report-json=report.json \
  --report-sarif=report.sarif \
  --report-markdown=report.md
```

Generate SBOM:
```bash
vet scan -D . --report-cdx=sbom.json
```

## 🧪 Re-query Saved Data

```bash
vet scan -D . --json-dump-dir ./.vet-scan
vet query --from ./.vet-scan --filter 'vulns.high.exists(p, true)'
```

## 🤖 Integrations

GitHub Action: **[safedep/vet-action](https://github.com/safedep/vet-action)**

GitLab Component: **[safedep/ci-components/vet](https://gitlab.com/safedep/ci-components/vet)**

Container: **[ghcr.io/safedep/vet](https://ghcr.io/safedep/vet)**

---
For complete documentation, advanced usage, troubleshooting, and more information, please visit: **[github.com/safedep/vet](https://github.com/safedep/vet)**