Refuse

What is Refuse?

Refuse sits in front of npm, pip, cargo, gem, go + 13 more package managers and refuses known-vulnerable installs before they hit disk — the moment you (or your coding agent) run them. Also, Open-source, self-hostable, one Docker container.

From the website

refuse — open-source shim that refuses vulnerable packages

Open-source shim for npm, pip, cargo, gem, go and 13 other package managers. Refuses vulnerable installs whether you ran them, your agent did, or CI did. 362,000+ advisories across 21 ecosystems.