Show HN: Sandbox the install step of any NPM package

A developer released a tool that sandboxes the install step of any NPM package, fetching the exact tarball npm install would and running declared install scripts in a sandbox with no network, dropped capabilities, and a read-only filesystem, returning a verdict signed under a published Ed25519 key bound to the sha256 of the bytes. The tool found that of 658 MCP-related packages, 20 declare an install script (3.0%), and all four preinstall scripts using npx only-allow pnpm made network calls at install because npx fetches only-allow from the registry. The developer notes the tool does not install dependencies, so it covers only the package's own declared install surface, not its transitive closure.

It fetches the exact tarball npm install would, runs the declared install scripts in a sandbox no network, all capabilities dropped, read-only filesystem , and returns a verdict signed under a published Ed25519 key, bound to the sha256 of the bytes. No account, it mints an anonymous rate-limit key on first call. Node and Python, 20 checks/hour. I built it to put a denominator under "npm install runs arbitrary code." Of 658 MCP-related packages, 20 declare an install script 3.0% . Running the twenty is where reading the manifest misled me: four were preinstall: npx only-allow pnpm, which I had filed as a benign guard, and all four make a network call at install because npx fetches only-allow from the registry. A manifest tells you what a script is; only running it tells you what it needs. Honest scope: dependencies are not installed, so this is a package's own declared install surface, not its transitive closure; and install-time is not the whole attack surface, a package can act at first import or at runtime instead. The verdict is a bounded, signed observation "under these constraints, these bytes did X" , not a safety oracle. Tell me where it is wrong. The failure I most want is a package it clears that you would have flagged. Comments URL: https://news.ycombinator.com/item?id=49308683 https://news.ycombinator.com/item?id=49308683 Points: 1 Comments: 0