Hardening Your Dependency Chain: An Introduction to DepsGuard

Supply chain attacks have become a primary vector for compromising modern software projects. By injecting malicious code into a popular dependency, attackers can gain access to thousands of downstream environments. While developers often focus on auditing the code they write, the configuration of the package managers used to fetch that code is frequently overlooked.

DepsGuard is a specialized tool designed to close these gaps. It provides a unified interface to scan and harden the configurations of the most popular package managers—including npm, pnpm, yarn, bun, and uv—as well as dependency update tools like Renovate and Dependabot. By enforcing "cooldown" periods and restricting dangerous installation behaviors, DepsGuard reduces the window of opportunity for malicious packages to enter your environment.

The Strategy: Cooldowns and Hardening

The core philosophy of DepsGuard revolves around two primary security mechanisms: release age gates and script restrictions.

Minimum Release Age (Cooldowns)

One of the most effective ways to mitigate "zero-day" malicious releases is to implement a minimum release age. By configuring your package manager to ignore any version released within the last few days (typically 7 days), you create a buffer. This window allows the security community to detect and report malicious versions before they are automatically pulled into your production or development environments.

DepsGuard checks for and applies these settings across various tools:

  • npm/pnpm/yarn/bun/uv: Enforces a delay (usually 7 days) before a new version is considered available.
  • Renovate/Dependabot: Configures update PRs to wait for a cooldown period, ensuring you aren't the first to test a potentially compromised update.

Restricting Installation Risks

Beyond timing, DepsGuard targets high-risk behaviors during the installation process:

  • ignore-scripts: Many supply chain attacks rely on preinstall or postinstall scripts to execute arbitrary code on the developer's machine. DepsGuard encourages setting this to true to neutralize these scripts.
  • Provenance and Trust: For pnpm users, the tool checks for trust-policy (to block provenance downgrades) and block-exotic-subdeps (to block untrusted transitive dependencies).
  • Strict Builds: It enforces strict-dep-builds in pnpm to ensure that build scripts are reviewed and approved.

Key Features and Workflow

DepsGuard is built as a single static binary in Rust with a strict policy of zero third-party crate dependencies, minimizing its own attack surface.

Interactive Hardening

The tool features an interactive Terminal User Interface (TUI) that allows developers to:

  1. Scan: Automatically detect global and repository-level config files.
  2. Review: See a list of recommended settings versus current settings.
  3. Preview: View a diff of the changes before they are applied.
  4. Apply: Commit the changes with a single keystroke.

Safety Mechanisms

Because editing configuration files can be disruptive, DepsGuard includes built-in safety nets. It creates timestamped backups of every file it modifies in ~/.depsguard/backups/ and provides a restore subcommand to roll back changes instantly if a configuration breaks a build.

Handling Urgent Security Fixes

A common critique of release age gates is that they prevent the immediate installation of critical security patches. DepsGuard addresses this by providing a guide on how to bypass cooldowns for specific packages.

Instead of lowering the global cooldown—which would re-expose the entire project—the tool recommends narrow exceptions. For example, in yarn, one can use YARN_NPM_MINIMAL_AGE_GATE=0s yarn up <pkg>@<ver> for a one-time override. In uv, the exclude-newer-package setting in uv.toml allows for a per-package exception.

Community Perspective

Early feedback from the community highlights the "invisible" nature of security tooling. As one user noted:

"The problem with security tooling is exactly this — you never see the attack you prevented."

While some users have reported challenges with the tool discovering certain project-level configurations, the consensus is that the automation of global config hardening provides significant value, especially for developers who may have missed specific flags in their manual security audits.

Summary of Supported Managers

Manager Primary Hardening Focus
npm Release age, script ignoring
pnpm Release age, exotic subdeps, trust policy, strict builds
yarn Minimal age gate
bun Minimum release age
uv Exclude newer publishes
Renovate/Dependabot Update PR cooldowns

Sources