Stop trusting dependencies
you never audited.
PackGuard is a local-first CLI and dashboard that governs package versions across every repo you own. Offset policy, supply-chain intel — CVE · malware · typosquat — and a live dependency graph. One Rust binary, no cloud.
Works with npm (npm · pnpm · yarn) and PyPI (poetry · uv · pip). Cargo + Go modules next.
Offset policy, not lockstep
Enforce "latest - N" with conservative defaults. Rust workspace, npm monorepo, pip-compile — all driven by one .packguard.yml.
Supply-chain intel included
OSV + GitHub Advisory + OSV-MAL + typosquat heuristic + optional Socket.dev — one sync, local SQLite, usable offline.
Graph with contamination chains
Trace any CVE from your workspace root to the vulnerable leaf. Transitive edges harvested from real lockfiles, not estimates.
From findings to next steps
Every CVE, malware hit, or policy violation becomes a prioritized action with a copyable fix command (pnpm · uv · poetry — auto-detected). Dismiss in the UI, the CI gate respects it.
Dashboard-first onboarding
Dark mode with a 3-state toggle, a tree view workspace selector built from your lockfile hierarchy, and an Add-workspace modal for the first scan. Monorepo navigation and onboarding without ever leaving the browser.
100% local, air-gap ready
One static Rust binary. No SaaS, no telemetry, no daemon. Bring your own intel dump and run on a disconnected build host.
One binary. One dashboard. Every workspace.
PackGuard ships a single Rust binary that embeds the dashboard, the REST API, and every CLI command. Run packguard ui locally and the UI opens in your browser against the same SQLite store the CLI writes to.
Overview at a glance
Health score, tracked packages, CVE matches, and supply-chain signals. Every number is scoped to the active workspace.
Trace a CVE to its root
The graph view runs a BFS from the vulnerable leaf and lights up every contamination chain. Same algorithm as packguard graph --contaminated-by.
Per-workspace policy
Monorepo-ready: each workspace has its own .packguard.yml with its own offset, stability, and block rules. Edit in the UI or on disk.
Install in thirty seconds.
Four channels, one binary. Pick whichever you already have on your path.