{"slug": "show-hn-sandbox-the-install-step-of-any-npm-package", "title": "Show HN: Sandbox the install step of any NPM package", "summary": "A developer released a tool that sandboxes the install step of any NPM package, fetching the exact tarball npm install would and running declared install scripts in a sandbox with no network, dropped capabilities, and a read-only filesystem, returning a verdict signed under a published Ed25519 key bound to the sha256 of the bytes. The tool found that of 658 MCP-related packages, 20 declare an install script (3.0%), and all four preinstall scripts using npx only-allow pnpm made network calls at install because npx fetches only-allow from the registry. The developer notes the tool does not install dependencies, so it covers only the package's own declared install surface, not its transitive closure.", "body_md": "It fetches the exact tarball npm install would, runs the declared install scripts in a sandbox (no network, all capabilities dropped, read-only filesystem), and returns a verdict signed under a published Ed25519 key, bound to the sha256 of the bytes. No account, it mints an anonymous rate-limit key on first call. Node and Python, 20 checks/hour.\n\nI built it to put a denominator under \"npm install runs arbitrary code.\" Of 658 MCP-related packages, 20 declare an install script (3.0%). Running the twenty is where reading the manifest misled me: four were preinstall: npx only-allow pnpm, which I had filed as a benign guard, and all four make a network call at install because npx fetches only-allow from the registry. A manifest tells you what a script is; only running it tells you what it needs.\n\nHonest scope: dependencies are not installed, so this is a package's own declared install surface, not its transitive closure; and install-time is not the whole attack surface, a package can act at first import or at runtime instead. The verdict is a bounded, signed observation (\"under these constraints, these bytes did X\"), not a safety oracle.\n\nTell me where it is wrong. The failure I most want is a package it clears that you would have flagged.\n\nComments URL: [https://news.ycombinator.com/item?id=49308683](https://news.ycombinator.com/item?id=49308683)\n\nPoints: 1\n\n# Comments: 0", "url": "https://wpnews.pro/news/show-hn-sandbox-the-install-step-of-any-npm-package", "canonical_source": "https://www.npmjs.com/package/@kenwea/mcp", "published_at": "2026-08-15 07:59:05+00:00", "updated_at": "2026-08-15 08:41:11.027099+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools"], "entities": ["NPM", "Ed25519", "MCP"], "alternates": {"html": "https://wpnews.pro/news/show-hn-sandbox-the-install-step-of-any-npm-package", "markdown": "https://wpnews.pro/news/show-hn-sandbox-the-install-step-of-any-npm-package.md", "text": "https://wpnews.pro/news/show-hn-sandbox-the-install-step-of-any-npm-package.txt", "jsonld": "https://wpnews.pro/news/show-hn-sandbox-the-install-step-of-any-npm-package.jsonld"}}