All 100 ideasServers and DevOps
#60 of 100 · Servers and DevOps
A seatbelt for npm installs
A package mirror that serves only vetted or weeks-old versions, blocks known malware, and checks published tarballs match the source.
Asks per year
What the askers want
- Would pay12%
- Want it local or private25%
- Object to subscriptions0%
- Want it open source or self-hosted12%
- Want AI to do it0%
Share of the 8 asks that say so, as judged by Jev.
What exists on Show HN
Built, still asked for7 Show HN launches do this job, and 6 more do part of it. People still ask, so the launches are missed, unknown, or not what they want. Ask what they’re missing before you build.
- Mitigate against 0-day supply chain attacks with safe-NPM2022 · 5 pts
- Pqurp – Quarantine Window for Packages to Prevent Supply Chain Attacks2026 · 5 pts
- TimeLock NPM Registry2025 · 4 pts
- PMG, open source package firewall2026 · 4 pts
- Hextrap – Package Firewall with OPA Policies and MCP Support2026 · 2 pts
- Stop malicious packages before NPM/pip install – open-source gateway2026 · 1 pts
- Computer Police – block malicious NPM/pip installs locally2026 · 1 pts
Instead of: npm, GitHub
The idea, as matched
A package proxy or mirror that only serves vetted or aged versions of npm, PyPI or Maven packages, blocks known-malicious releases, and flags tampered tarballs or unsafe CI workflows.
Jev first matched 18 requests to this idea; a second reader kept 8 of 18.
Every ask, newest first
Each line is an AI paraphrase of what the writer wanted. The link goes to their own words on Hacker News.
Reader’s note. Asks follow each npm or PyPI compromise; many adjacent security wishes excluded.
- Feb 2026Wants an in-house mirror for Java and npm libraries, limited to a vetted allowlist. Read it: a comment in “Show HN: Artifact Keeper – Open-Source Artifactory/Nexus Alternative in Rust”
- Nov 2025Wants a curated, safe, compatible set of npm packages like a Linux distribution, which businesses would pay for. Read it: a comment in “Shai-Hulud Returns: Over 300 NPM Packages Infected”
- Sep 2025Wants a proxy between the npm client and registry serving month-old versions and never serving known-infected ones. Read it: a comment in “We all dodged a bullet”
- Jun 2024Suggests there may be paid demand for vetting and hosting a small set of popular JavaScript libraries. Read it: a comment in “Polyfill supply chain attack hits 100K+ sites”
- Mar 2024Wants an automated check comparing package tarball contents against the repository, warning when they differ. Read it: a comment in “Backdoor in upstream xz/liblzma leading to SSH server compromise”
- Jan 2022Would pay for an npm mirror of last-known-good versions, held a few weeks behind the registry. Read it: a comment in “Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps”
- Mar 2021Wants npm packages to be built from source verifiably, so what runs matches the visible Git commit. Read it: a comment in “The Deno Company”
- Jul 2019Wants a web of trust where reviewer endorsements carry weights, letting teams choose dependencies by review level. Read it: a comment in “Malicious code in the purescript NPM installer”
Building this?
Read ten of the asks above first, because they say what the existing launches miss. If you ship it, post it as a Show HN so the next run of this list finds it.
Ship it like Vercel, on a server you own
This site runs on ShipTiffin. A push to GitHub deploys it, the way it would on Vercel, but the server is a Hetzner box in your own account. Postgres, sign-in, email, jobs and analytics are already on it, every project gets a hard limit, and nothing is billed by usage.
$19 a month per box, plus about $10 for the server at Hetzner. Open source, so you can also run it yourself for free.