Release v0.1.0 · nisconder/npm-safe

@npm-safe/core v0.1.0

Local-first npm package security engine — static and LLM-based supply-chain analysis, SQLite cache, CLI and desktop GUI.

Engine core: registry client, package validators, 10 static analysis rules, token-bucket rate limiting, TTL cache, auto-refresh scheduler.
Multi-provider LLM scan: optional semantic analysis via OpenAI, Google Gemini, or Anthropic Claude with strict response validation and score fusion (60/40 static/LLM).
CLI (npm-safe): check, search, watch, refresh, settings, lang, rules, llm, ci, report, telemetry, gate, install, doctor — 14 commands plus JSON output and proxy support.
Neutralinojs desktop GUI with a Material You (M3) dashboard: overview, check, search, watch, rules, LLM, settings; light/dark themes; persistent check history shared with the CLI.
Install-time security gate (opt-in, default off): intercepts npm/pnpm/yarn installs and checks every package, with shell wrappers and Windows PATH shims.
Structured command log: every CLI invocation appended as JSONL to ~/.npm-safe/commands.jsonl.
Agent skill: npm-safe-scan auto-installed to ~/.agents/skills/ on package install.
Plugin system for custom scan rules; CI dependency scan; batch checks; report export (JSON/CSV); opt-in local telemetry.
Apache-2.0 license, SLSA provenance attestation.

Bug screen (2026-08-02) fixed 12 issues including two critical XSS-to-RCE exposures in the desktop GUI; all rendered fields are escaped.
No shell injection in the install gate (argv-based child processes only).
Telemetry is opt-in and local-only (no network).

Portable app: download npm-safe-release.zip from the assets below, extract it, and run the npm-safe executable (Windows) / npm-safe binary (macOS, Linux).
The app bundles the @npm-safe/core engine and stores data in ~/.npm-safe/.
Built-in auto-updater: on startup the app checks update_manifest.json and installs newer resources.neu payloads automatically.