npm ci and pip install.DevShield is a local guard for dependency installs. You wrap the install command; it kills hostile lifecycle scripts, requires a pinned lockfile, flags exposed secrets, and blocks off-allowlist network connections — all on your machine, zero external dependencies.
DevShield is a checkpoint tool: it only protects installs you route through it. A bare npm ci run alongside is invisible to it. You harden your CI and your blessed local path — not "install this and you're safe everywhere".
No external dependencies: a stable Rust toolchain is all you need.
DevShield runs your command, applies the gates you enabled, and (with --audit-log) writes a local JSONL trail. Every gate defaults to warn (non-destructive); you escalate to block or fail when you want to harden.
Each is independent and non-destructive by default. Stacked, they cover the most common install vectors.
block disables npm install scripts (injects --ignore-scripts); fail refuses (exit 21) before spawning. Also gates npx / npm exec / pnpm dlx as arbitrary code execution. pip: warn-only. The layer that stops Shai-Hulud / Axios-style payloads.
Flags (or refuses, exit 22) a missing/unhashed npm lockfile, or a command that mutates the lockfile (npm install) instead of respecting it (npm ci). Posture, not tamper detection — npm already verifies hashes. pip: best-effort, warn-only.
Reports secret-bearing env vars and files (.env, .npmrc, .pypirc…) before the install runs — without ever printing the values. fail → exit 20.
A local (127.0.0.1) proxy the install is routed through. enforce blocks (403) any connection to an off-allowlist host. No MITM: blocks by host, never by content. warn logs everything; a bind failure in enforce → exit 23 (fail-closed).
| Mode | Effect | DEVSHIELD_MODE |
|---|---|---|
| warndefault | Runs unchanged; logs a lifecycle_scripts event. | audit-only |
| block | Disables scripts for npm (injects --ignore-scripts + npm_config_ignore_scripts). pip / npx: warn-only. | enforce |
| fail | Exits 21 before spawning if scripts would run. Unrecognized command → refused (fail-closed). | enforce |
Coverage caveat:block script-disabling is verified for npm. yarn Berry (v2+) ignores npm_config_* and doesn't honor --ignore-scripts; verify before relying on it for pnpm/yarn.
| Code | Meaning |
|---|---|
| 0 | Child ran; no gate refused. |
| child code | Passed through from the wrapped command. |
| 20 | --preflight-mode fail: secret risk detected. |
| 21 | --scripts-mode fail: lifecycle scripts would run. |
| 22 | --lockfile-mode fail: lockfile posture risk. |
| 23 | --egress-mode enforce: proxy could not start (fail-closed). |
| 10 | check / observe egress: destination blocked by policy. |
| 2 | Usage / argument error. |
| 125 · 127 | Audit-log write failure (125) · command execution failure (127). |
It's where supply-chain attacks actually land, it's central, and it's impossible to forget. Swap one line and fail the build closed on risk:
Other anchors: a shell alias (alias npm='devshield run … -- npm') for transparent local use; a shared Makefile / just target for the team; a dev container's postCreateCommand.
Events: command_run, lifecycle_scripts, secret_preflight, lockfile_preflight, egress_observation. All local; nothing is transmitted.
No system-wide interception. A bare npm ci is invisible. The shell alias comes closest, but is opt-in and bypassable.
--scripts-mode stops execution/exfiltration; it won't tell you a package was swapped. npm already verifies integrity on install.
The proxy blocks by host:port, no MITM. It can't tell a download from a publish on an allowlisted host. github.com stays allowed by default.
A postinstall that wipes files is stopped only if scripts are disabled (block/fail). No network control helps here.
Use DevShield to harden your CI and your blessed local path, layered with lockfile pinning and package provenance — not as "install this and you're safe everywhere".