SafeDep blocks malicious open-source packages at install time across dev machines, CI/CD, repos and AI agents.
- for
- Developers, security teams and organizations that ship code using third-party packages.
- pricing
- freemium · free trial
- license
- Apache-2.0
- v2.0.0-alpha.2026100605174324 days ago
- v2.0.0-alpha.2026100506395125 days ago
- v2.0.0-alpha.2026100416372225 days ago
Key features
- Install-time blocking — Intercepts npm, pnpm, pip, uv, bun and other managers to refuse malicious packages before they run.
- Policy-as-code enforcement — One CEL policy applied at every SDLC endpoint – dev machine, CI, repo and AI agent.
- Org-wide inventory — Tracks packages, AI agents, skills and MCP servers per machine, project and user.
- Pull-request checks — GitHub App posts malware, vulnerability and license verdicts on each PR as a required check.
- CI/CD proxy — Runs as a proxy in pipelines, stopping malicious installs and failing the job on violations.
- Threat intel feed — Optional add-on provides a continuous stream of confirmed malicious packages and indicators.
Use cases
- Block malicious npm or PyPI packages on developers' laptops.
- Prevent AI coding assistants from pulling poisoned dependencies.
- Enforce package safety in CI pipelines before build artifacts are created.
- Require clean dependency scans on every pull request merge.
vet pricing
- Free$0 foreverUp to 3 SDLC endpoints · Real-time malicious package protection · 7-day findings history · Centralized policies
- Team$80 per month/monthReal-time protection across all endpoints · 90-day findings history & audit trail · 50 on-demand package scans / month · Email support
vet vs alternatives
 vet |  Snyk |  Pulumi |  Neovim |  Doppler | |
|---|---|---|---|---|---|
| Best for | Policy-driven supply-chain protection | Vulnerability management | IaC deployment | AI pair programming | Secret storage |
| Pricing | Freemium | Subscription | Free | Free | Subscription |
| DevHunt upvotes | 0 | 0 | 0 | 0 | 0 |
| Launched | Jan 2026 | — | — | — | — |
- vet vs Snyk: Focuses on vulnerability scanning of code and containers, not real-time package install blocking
- vet vs Pulumi: Infrastructure-as-code provisioning, not supply-chain package protection
- vet vs Neovim: Open-source AI coding agent, whereas SafeDep secures packages for agents
- vet vs Doppler: Secrets management, not package safety enforcement
vet FAQ
Do I need a credit card to start?+
No, the 30-day trial requires only basic details and no card.
How are CI runners counted as endpoints?+
Ephemeral runners are fingerprinted to a single CI endpoint, not counted per build.
What happens after the trial ends?+
You automatically move to the Free plan with protection on up to 3 endpoints; org-wide features pause until you subscribe.
Are the open-source tools still free?+
Yes, vet, pmg and gryph remain free, open-source and unmetered with no account required.
How does SafeDep differ from EDR?+
EDR monitors processes after they run; SafeDep blocks malicious packages before they are installed in the SDLC.
Summarized by DevHunt from safedep.io · Oct 6, 2026. Details may change; check the official site.
vet in the news
Recent vet news and updates from DevHunt Daily.
· Hacker News
LiteLLM 1.107.0 on PyPI contained a credential stealer and backdoor
The 1.107.0 release of the LiteLLM Python package was found to install malicious files that steal SSH keys, cloud credentials and other secrets, and run a remote code execution daemon. The malicious code was removed from PyPI after discovery, highlighting the risk of compromised packages for developers.
.svg?width=64)
