Pre-install security gate for npm lifecycle scripts.
Inspect install hooks, detect token theft and reverse shells, and enforce confidence-gated policy routing before code executes.
npx pkg-gate esbuild
npm install pkg-gate
Select a curated scenario to evaluate
Target Input
Phase 1: Spec ExtractionCalls model jev-latest directly via HTTPS. Key is never transmitted anywhere else.
Lifecycle Script Evaluation (1 found)
Policy Verdict Triggers
Equivalent Terminal Command
npx pkg-gate test/fixtures/credential-theft.json
End-to-End Security Architecture
How pkg-gate intercepts lifecycle hooks, fans out parallel evaluation questions to TypeSafe System One, and routes decisions through confidence-gated thresholds.
Never guess on uncertain signals.
Standard AI evaluations either blindly hallucinate confidence or pass ambiguous payloads. pkg-gate defines a strict confidence floor of 50%. When model ambiguity spikes, execution automatically routes to human interactive confirmation with exact reasons.
Calibrated scores, not fuzzy rules.
TypeSafe System One provides structured probability distributions for intent, threat severity, and secret access. The gating decision is strictly code-defined: Block at score >= 2.0 or secret probability >= 0.60; Warn at score >= 1.2 or recon activity.
Parallel evaluation across lifecycle hooks.
Packages with multiple hooks (preinstall, install, postinstall) are evaluated concurrently in parallel. If zero lifecycle scripts are defined, pkg-gate short-circuits instantly in less than 1ms with a guaranteed safe verdict.
Calibrated local fallback engine.
Without an API key or when network connectivity drops, pkg-gate automatically falls back to an offline rule-calibrated simulator that replicates the System One answer schema so development pipelines never halt.