Aikido Safe Package Manager

The Aikido Safe Package Manager wraps around the npm cli to provide extra checks before installing new packages. This tool will detect when a package contains malware and prompt you to exit, preventing npm from downloading or running the malware.

Installation

To install the Aikido Safe Package Manager, you can use the following command:

npm i -g @aikidosec/safe-package-manager-internals

Now you should be able to use the aikido-npm command. Example: aikido-npm install axios.

Api key

The Aikido Safe Package Manager requires an API key to work. You can get your API key by signing up at Aikido. Once you have your API key, you can set it using the following command:

aikido-npm set-aikido-token YOUR_API_KEY

Aliases in shell

It is possible to create an alias for aikido-npm so that it runs whenever you run an npm command. That way you can run npm install some-package and it will execute the aikido-npm install some-package command instead, ensuring you are protected.

Creating an alias

To add an alias to your shell startup script, you can use the built-in command aikido-npm add-aikido-npm-alias:

# Example for bash
aikido-npm add-aikido-npm-alias ~/.bashrc

# Example for zsh
aikido-npm add-aikido-npm-alias ~/.zshrc

# Exaple for powershell
aikido-npm add-aikido-npm-alias $PROFILE

This will create the alias, but only if the file exists. The following table shows the alias that will be created in the shell startup script:

| Shell | Startup script | Alias | | -------------- | -------------------------- | --------------------------------------- | | Bash | ~/.bashrc | alias npm='aikido-npm' | | Zsh | ~/.zshrc | alias npm='aikido-npm' | | Ash | ~/.profile, ~/.ashrc | alias npm='aikido-npm' | | Fish | ~/.config/fish/config.fish | alias npm "aikido-npm" | | Powershell | $PROFILE | Set-Alias -Name npm -Value aikido-npm |

After adding the alias, the shell needs to restart in order to load the alias.

Removing the alias

To remove the alias, you can use the built-in commands of aikido-npm:

• aikido-npm remove-aikido-npm-alias file_name (eg ~/.bashrc, ~/.zshrc, etc.) This will remove the alias if it is present in the file.