safe‑install: npm Package to Disable Install Scripts and Whitelist Dependencies

In response to ongoing npm supply‑chain compromises, developer gkiely released the @gkiely/safe‑install package on npm. The tool disables install scripts by default, mirroring Bun’s trusted dependencies feature, and allows developers to define a whitelist of dependencies that may run build or install scripts. It also supports blocking exotic sub‑dependencies, similar to pnpm’s blockExoticSubdeps setting, providing an extra layer of protection against malicious packages. The package is available at https://npmjs.com/package/@gkiely/safe‑install and can be integrated into existing npm workflows. It addresses a gap in npm’s built‑in security features, which currently lack script‑execution controls. By using safe‑install, teams can mitigate the risk of supply‑chain attacks without altering their package.json structure. The tool is lightweight, requiring only a single dependency and a configuration file. It is ideal for projects that prioritize security and wish to enforce strict dependency policies.