🛡️ dephold

Hold new dependency versions until they age. Supply chain protection across all ecosystems via deps.dev.

Born from the axios npm attack (2026-03-31) and the litellm PyPI attack (2026-03-24).

Install

npm install -g @eastagile/dephold

Restart your terminal. Done.

How it works

Shell hooks automatically intercept install commands across 15 package managers. Each package is checked against deps.dev — if the version was published less than the hold period (default: 3 days), the install is blocked.

| Manager | Intercepted commands | |---------|---------------------| | npm, yarn, pnpm, bun | install, add, update | | pip, pip3, poetry, uv, pdm, pipenv | install, add | | cargo | add, install | | go | get | | gem, bundler | install, add | | dotnet | add package |

Non-install commands and lockfile restores pass through untouched.

Commands

dephold status                            # Show current state
dephold hold [days]                       # Set hold period (default: 3)
dephold off [seconds]                     # Pause (default: 300s, max: 3600s)
dephold on                                # Resume
dephold <ecosystem> <package> [version]   # Direct check

Hold period

The default hold period is 3 days. This is based on real incident data — Socket flagged the axios malware in 6 minutes, and litellm was pulled from PyPI within 3 hours. 3 days gives a comfortable buffer past the detection window of every major supply chain attack in 2025-2026, while Sonatype Repository Firewall monitors quarantined components for up to 14 days.

dephold hold          # Show current hold period
dephold hold 7        # Set to 7 days
dephold hold 1        # Set to 1 day (aggressive)
dephold hold 0        # Disable (allow all versions)

The setting persists in ~/.dephold/config.json. The DEPHOLD_DAYS env var overrides it.

Pause temporarily

dephold off           # Pause for 5 minutes (default)
dephold off 600       # Pause for 10 minutes
dephold off 3600      # Pause for 1 hour (maximum)
dephold on            # Resume immediately

Auto-expires. Maximum 1 hour regardless of input.

CI/CD

Shell hooks only work in interactive terminals. For CI:

dephold npm axios 1.14.0 || exit 1
dephold pypi flask 3.0.0 || exit 1

Audit log

All checks are logged to ~/.dephold/audit.log.

Uninstall

npm uninstall -g @eastagile/dephold
# Remove the "dephold" block from ~/.bashrc or ~/.zshrc
rm -rf ~/.dephold

Requirements

Node.js 18+, bash or zsh.

License

MIT — © 2026 East Agile. See LICENSE.