pkg-gate
Pre-install security gate for npm lifecycle scripts using TypeSafe System One.
Overview
pkg-gate evaluates package names or raw install scripts with TypeSafe System One before npm hooks run. It exposes TUI and JSON structured output for CI.
Problem: npm lifecycle scripts can exfiltrate or install before humans read package.json hooks.
Built for: Node developers who want a pre-install gate with structured allow, warn, and block verdicts.
First indexed on Jev Directory: 2026-09-19
Creator and team
- Name
- Hemanth HM
- Handle
- @GNUmanth
“Intent-aware package installs: block the dependency you did not mean before npm writes to disk.”
How Jev is used
- Role in the product flow
- Pre-install security gate on lifecycle scripts
- Primitives
- ChoiceScore
- State in
- Package metadata or raw shell script strings passed to pkgGate(); hooks extracted from package.json for local paths.
- Decision out
- report.action allow | warn | block with structured intent.choice and probability fields (README structured output example).
- Extract preinstall, install, postinstall scripts
- Evaluate each script in parallel via System One
- Route low confidence to human review per README confidence gate
pkg-gate treats install intent as a Choice problem (example structured field intent.choice: credential_access) and uses Score-style probabilities such as accessesSecrets.probability in documented JSON output. Without TYPESAFE_API_KEY the README documents an offline calibrated simulator fallback.
Sourced performance claims
- Low confidence (conf < 0.50) routes to human review instead of automatic block.Source: github.com/hemanth/pkg-gate README
Features and stack
Features
- pkgGate() API plus CLI
- Structured JSON for agents and CI
- Raw script evaluation mode
- Interactive demo site
Stack
- Node.js
- TypeSafe System One
- npm lifecycle hooks
Pricing: Requires TYPESAFE_API_KEY for live Jev; offline simulator without key per README.
Demo
Showcase clip with the same lightbox player as the homepage. Click to play.
pkg-gate
Intent-aware package installs: block the dependency you did not mean before npm writes to disk.
Links
FAQ
- Does pkg-gate replace npm audit?
- No. It judges install script intent, not CVE databases.
Tags
Related learn guides
Original Jev guidance that pairs with this product pattern.
- Jev vs LLM classification
When to gate with System One probabilities instead of asking a chat model to label things.
- Jev use cases
The patterns builders actually search for: moderation, routing, triage, RAG verify, and agent gates.
Related products
Hand-picked neighbors with rich profiles or overlapping tags.