@aikidosec/safe-npm

Aikido Safe Package Manager

The Aikido Safe Package Manager wraps around the npm cli, npx, and yarn to provide extra checks before installing new packages. This tool will detect when a package contains malware and prompt you to exit, preventing npm, npx, or yarn from downloading or running the malware.

Installation

To install the Aikido Safe Package Manager, you can use the following command:

npm i -g @aikidosec/safe-npm

Now you should be able to use the aikido-npm, aikido-npx, or aikido-yarn command instead of npm, npx, or yarn. Example: aikido-npm install axios, aikido-yarn add lodash.

Aliases in shell

It is possible to create aliases in your shell startup script to make it easier to use the Aikido Safe Package Manager. This is useful if you want to use the Aikido Safe Package Manager as a drop-in replacement for npm, npx, or yarn. The aikido-npm, aikido-npx, and aikido-yarn commands will scan for malware and prompt you to exit if any is found. If not, they will run the original npm, npx, or yarn command.

Creating an alias

The add-aikido-aliases command will add the aliases for npm, npx, and yarn to your shell startup script.

To add aliases to your shell startup script, you can use the built-in command aikido-npm add-aikido-aliases:

# Example for bash
aikido-npm add-aikido-aliases ~/.bashrc

# Example for zsh
aikido-npm add-aikido-aliases ~/.zshrc

# Example for powershell
aikido-npm add-aikido-aliases $PROFILE

This will create the aliases. The following table shows the aliases that will be created in the shell startup script:

Shell	Startup script	Npm Alias	Npx Alias	Yarn Alias
Bash	~/.bashrc	alias npm='aikido-npm'	alias npx='aikido-npx'	alias yarn='aikido-yarn'
Zsh	~/.zshrc	alias npm='aikido-npm'	alias npx='aikido-npx'	alias yarn='aikido-yarn'
Ash	~/.profile, ~/.ashrc	alias npm='aikido-npm'	alias npx='aikido-npx'	alias yarn='aikido-yarn'
Fish	~/.config/fish/config.fish	alias npm "aikido-npm"	alias npx "aikido-npx"	alias yarn "aikido-yarn"
Powershell	$PROFILE	Set-Alias -Name npm -Value aikido-npm	Set-Alias -Name npx -Value aikido-npx	Set-Alias -Name yarn -Value aikido-yarn

After adding the alias, the shell needs to restart in order to load the alias.

Removing the alias

To remove the added aliases, you can use the built-in commands of aikido-npm:

• aikido-npm remove-aikido-aliases file_name (eg ~/.bashrc, ~/.zshrc, etc.) This will remove the aliases if they are present in the file.

Configuration

The Aikido Safe Package Manager has a few configuration options that you can set. These options are stored in the config file located at ~/.aikido/config.json, or can be set using environment variables. The following options are available:

The config file is a JSON file with the following structure

{
  "scanTimeout": 10000
}

Scan timeout

The scan timeout is the time in milliseconds that the Aikido Safe Package Manager will allow a scan to take before timing out. The default value is 10000 (10 seconds). You can set it in the config file at ~/.aikido/config.json or by setting the environment variable AIKIDO_SCAN_TIMEOUT_MS. The value must be a number greater than 0.