Phi v0.4.1 is out — Production-ready supply chain security for Node.js.
<h3>The Core Problem</h3>
Supply chain attacks continue to hit npm hard. Most tools (including <code>npm audit</code>) only scan after packages are downloaded and often after <code>postinstall</code> scripts have already run. By then, it’s usually too late.
Phi solves this at the architectural level.
<h3>What is Phi?</h3>
Phi is an install-time supply chain firewall. It:
<ul>
<li>Resolves the full dependency tree (including transitives)</li>
<li>Downloads tarballs</li>
<li>Scans everything in memory using 13 detectors + OSV database</li>
<li>Gives a verdict (Block / Review / Install) before any code touches your disk</li>
<li>Disables lifecycle scripts by default</li>
<li>Single static Go binary, MIT licensed, no daemon, no telemetry</li>
</ul>
<h3>What’s New in v0.4.1 / v0.4.0</h3>
<ul>
<li><code>phi ci</code> — Dedicated production/CI command (perfect for Vercel, Railway, <a href="http://Fly.io" target="_blank" rel="noopener nofollow">Fly.io</a>, GitHub Actions, Docker)</li>
<li><code>-y / --yes</code> flag — Auto-approves <code>REVIEW</code> packages (locally reviewed)</li>
<li><code>--omit=dev</code> — Skip <code>devDependencies</code> (full npm parity)</li>
</ul>
<code>phi ci</code> treats your <code>phi.lock</code> as the trusted audit record. Anything approved locally installs cleanly in production. Blocked packages still fail fast.
Other strong features:
<ul>
<li><code>phi x</code> (exec) — Much safer <code>npx</code> alternative (fetch + full scan + run)</li>
<li><code>phi create</code> — Scaffolds popular frameworks with Phi’s security pipeline</li>
<li><code>phi audit fix</code> — Smart auto-fixing for typosquats, deprecations, and advisories</li>
<li>Excellent <code>phi why</code> and detailed reporting</li>
</ul>
<h3>Quick Start</h3>
<pre><code># Install Phi
curl -sSL https://phi.philtechs.org/install.sh | sh

# Use it
phi install
phi ci --omit=dev # Production / Docker
phi x cowsay &quot;Hello Phi&quot; # Safer npx
</code></pre>
Website &amp; Docs: <a href="https://phi.philtechs.org" target="_blank" rel="noopener nofollow">https://phi.philtechs.org</a>
GitHub: <a href="https://github.com/philtechs-org/phi" target="_blank" rel="noopener nofollow">https://github.com/philtechs-org/phi</a>

Prosper Maxwell

Phi v0.4.1 is a supply chain firewall for npm that intercepts packages before they touch disk. Unlike npm audit, Phi resolves the full dependency tree, downloads tarballs, and scans everything in memory using 13 detectors plus the OSV database, issuing a Block/Review/Install verdict before any code executes. It disables lifecycle scripts by default and ships as a single static Go binary with no daemon or telemetry. New in v0.4.1: a dedicated phi ci command for CI/CD pipelines (Vercel, Railway, GitHub Actions, Docker), a --yes flag for auto-approving reviewed packages, and --omit=dev support. Additional features include phi x as a safer npx alternative, phi create for scaffolded project setup, and phi audit fix for auto-remediation of typosquats and advisories.

Phi: The Install-Time Supply Chain Firewall for npm