Skip to main content

PMG Repository

View the PMG source code and contribute on GitHub
Package Manager Guard (PMG) wraps your package manager and blocks malicious packages at install time.
PMG requires no configuration - just install and use it as you normally would with your package managers.
For what PMG is and how it works, see the PMG overview.

​
Installation

​
Using Homebrew (macOS and Linux)

​
Using Go Install

​
Download Binary

Download the latest release from our GitHub releases page and add it to your PATH.

​
Windows

Use Windows 10 or 11. Download pmg_Windows_x86_64.zip from a v0.29.0 or later release, extract pmg.exe, and add its directory to your PATH. The release is x86-64 only. ARM64 runs it under emulation. 32-bit Windows is not supported. Windows support requires PMG v0.29.0 or later. For Node.js installed by its MSI, winget, or Chocolatey, use the Windows system install. These installers put Node on the machine PATH, ahead of every per-user shim. Until system install is complete, invoke pmg npm explicitly.

​
Quick Setup

Run PMG’s automated setup:
Setup creates package-manager PATH shims and the ~/.pmg.rc alias layer for bash, zsh, and fish. Restart your terminal or source your shell’s config file to activate it.
Verify protection with the benign test package. PMG must block it:

​
Manual Usage (Alternative)

To invoke PMG explicitly:
If PMG detects a malicious package, it blocks the install and displays a warning.

​
Supported Package Managers

PMG supports these tools from the PMG README:
The aube tools (aube, aubx, and aubr) are not part of the initial Windows support. See the Windows support reference.

​
Troubleshooting

​
If PMG isn’t working after setup

  1. Restart your terminal
  2. On macOS or Linux, run type npm to check for a PMG alias or shim. If it resolves to the real manager, run pmg setup install again and restart the terminal.
  3. On Windows, run Get-Command npm in PowerShell. It should resolve under %LOCALAPPDATA%\safedep\pmg\bin for a per-user setup, or %ProgramFiles%\safedep\pmg\bin for system install.
  4. Run pmg setup doctor to check PATH, shims, and config, and pmg version to check the installed version.

​
Windows coverage

Use PowerShell or cmd.exe for automatic interception. In Git Bash, invoke pmg npm or pmg pip explicitly. Run pmg setup doctor to diagnose setup problems. See the Windows support reference for PATH behavior, supported shells, WSL, and platform limitations.

​
If packages are incorrectly blocked

  1. Run with --verbose to see detection details
  2. Check the SafeDep community for known issues
  3. Report false positives on GitHub Issues

​
Next Steps

Run pmg --help to see all available commands and options. PMG runs transparently in the background and only surfaces when it blocks a malicious package.