Safer-dependencies is a security layer for Claude Code that audits

Robert Auger launched Safer-dependencies, an automated security layer designed specifically for Claude Code to intercept and audit software dependencies before and after they enter a project. As AI coding assistants gain autonomy, they frequently install or declare external packages without verifying security posture, maintenance status, or potential typosquatting risks. According to github.com's report, Safer-dependencies addresses this blind spot by running continuous checks across seven major package ecosystems: npm, PyPI, RubyGems, Maven, Go, Rust, and PHP Composer.

This article details how Safer-dependencies works, its security checks, and how developers can integrate it into their local Claude Code environment. Designed for software engineers, security operators, and teams using AI assistants in production codebases, this guide explains how the security layer catches vulnerabilities and manages package lifecycles automatically.

What shipped in Safer-dependencies is a security layer

Safer-dependencies shipped as a combined skill and hook bundle that acts as an automated guardrail for Claude Code during package operations. When Claude Code attempts to add, update, or search for dependencies, Safer-dependencies executes five distinct verification checks before permitting changes to manifest files or package-manager executions. It evaluates package provenance against official registries to block typosquats, checks version release dates against a defined cooldown window, and scans for known CVEs using the OSV API alongside native auditing tools like npm audit, pip-audit, or bundle audit.

In addition to scanning for vulnerabilities, Safer-dependencies inspects package hashes and checks overall maintenance status across project files. For PyPI requirements files containing hash pins, it validates declared hashes against PyPI published hashes and flags any mismatch with a warning. Furthermore, the system detects abandoned or unmaintained packages, immediately hard-blocking software such as paperclip, request, pycrypto, or jwt-go, while removing them from manifests and issuing advisories for packages with no stable release in over two years.

What improved in Safer-dependencies is a security layer

The release of Safer-dependencies improves local developer security by replacing manual dependency audits with continuous background intercept hooks. Unlike standalone AI skills that rely on the assistant deciding to invoke security checks manually, Safer-dependencies deploys five specialized shell hooks that cover pre-install, post-install, write operations, and subagent tool execution. Pre-Install hooks audit command arguments in real time to deny vulnerable installations before execution, while Post-Install hooks inspect lockfiles for transitive CVEs right after a package-manager command completes.

These structural enhancements allow Safer-dependencies to correct risks automatically across different execution environments without requiring user interaction. All security checks and automated remediation events are recorded in monthly audit log files stored locally in the home directory. The system reduces security vulnerabilities across seven major language ecosystems while maintaining consistent manifest tracking.

What you gain from Safer-dependencies is a security layer

Integrating Safer-dependencies provides developers with automated protection against supply chain attacks, zero-day dependency issues, and malicious typosquats without disrupting standard coding workflows. The system automatically triggers across a wide variety of development actions, including manifest edits to package.json or requirements.txt, lockfile generation, Dockerfile creations, and scaffolding commands like npx create-react-app or cargo new. It also intercepts intent-to-use expressions and library recommendation queries inside chat prompts, ensuring safe recommendations long before code is written.

Developers gain passive enforcement without adding operational friction or slowing down daily development tasks. Once the hook bundle is configured, vulnerable dependency declarations are upgraded to safe versions on disk, while known-vulnerable package installations are denied outright. Standard library imports and existing, unedited project dependencies remain untouched, preventing unnecessary noise while isolating new supply chain risks as they are introduced.

How to get Safer-dependencies is a security layer

To install Safer-dependencies, developers clone the official repository directly into a temporary directory on their local machine. Running the included Python interactive management script guides the user through prerequisite validation and hook configuration in under five minutes.

git clone https://github.com/robert-auger/safer-dependencies /tmp/safer-dependencies

python3 /tmp/safer-dependencies/skills/scripts/safer_dependencies_manager.py

claude "check safer-dependencies setup"

claude "show safer-dependencies stats"

What to watch after Safer-dependencies is a security layer

Following installation, developers should monitor how Safer-dependencies handles commercial licensing requirements and subagent tool executions. The tool is available under a source-available license that is free for personal, internal company, and commercial product development use. However, a separate paid commercial license requested directly from Robert Auger is required if the software itself is monetized, hosted as a paid service, or resold to third parties.

Teams using Claude Code subagents must ensure all five hooks remain active, particularly the Post-Agent pair, to prevent secondary processes from writing un-audited manifests. Users can query security metrics or inspect monthly audit logs stored in their home directory at any time to verify system health and blocked vulnerability counts.