kirishima 🗿

Harden your npm dependencies. No lockfile drama.

Inspired by Eijiro Kirishima — because your dependencies should be unbreakable.

The problem: package-lock.json is 10k lines nobody commits, node_modules is huge, and npm install in CI can silently pull a different version than what you tested. pnpm and bun solved this better — but they're not the default.

Kirishima fixes the npm weak point without making you switch tools.

Install

npm install -g kirishima

Commands

| Command | What it does | |---|---| | kirishima snapshot | Reads node_modules, saves .hardened.json with exact versions | | kirishima check | Validates installed versions against the snapshot | | kirishima install | Runs npm install then checks the snapshot | | kirishima harden | Pins all versions in package.json to exact (no ^ or ~) | | kirishima unharden | Restores package.json from backup | | kirishima config | Configure kirishima (language, etc) | | kirishima unconfig | Reset configuration to defaults |

Typical workflow

# After npm install, lock what you have
kirishima snapshot

# Commit .hardened.json (tiny, readable)
git add .hardened.json

# In CI, instead of npm install
kirishima install

.hardened.json format

Small, human-readable, actually committable:

{
  "version": 1,
  "locked": {
    "express": "4.18.2",
    "lodash": "4.17.21",
    "chalk": "5.3.0"
  }
}

Language support

Kirishima supports 20 languages for CLI output. Run kirishima config to choose.

Serious: English, Português (BR), Español, Français, Deutsch, Italiano, 日本語, 中文, 한국어, Русский, العربية, हिंदी, Türkçe, Polski

Fun: Pirate English ☠️, L33tspeak, Português raiz 🇧🇷, Kirishima Mode 🗿, Minimalista (só emojis), UwU

To reset language: kirishima unconfig

License

MIT