Phi v0.4.1 is out — Production-ready supply chain security for Node.js.
<h3>The Core Problem</h3>
Supply chain attacks continue to hit npm hard. Most tools (including <code>npm audit</code>) only scan after packages are downloaded and often after <code>postinstall</code> scripts have already run. By then, it’s usually too late.
Phi solves this at the architectural level.
<h3>What is Phi?</h3>
Phi is an install-time supply chain firewall. It:
<ul>
<li>Resolves the full dependency tree (including transitives)</li>
<li>Downloads tarballs</li>
<li>Scans everything in memory using 13 detectors + OSV database</li>
<li>Gives a verdict (Block / Review / Install) before any code touches your disk</li>
<li>Disables lifecycle scripts by default</li>
<li>Single static Go binary, MIT licensed, no daemon, no telemetry</li>
</ul>
<h3>What’s New in v0.4.1 / v0.4.0</h3>
<ul>
<li><code>phi ci</code> — Dedicated production/CI command (perfect for Vercel, Railway, <a href="http://Fly.io" target="_blank" rel="noopener nofollow">Fly.io</a>, GitHub Actions, Docker)</li>
<li><code>-y / --yes</code> flag — Auto-approves <code>REVIEW</code> packages (locally reviewed)</li>
<li><code>--omit=dev</code> — Skip <code>devDependencies</code> (full npm parity)</li>
</ul>
<code>phi ci</code> treats your <code>phi.lock</code> as the trusted audit record. Anything approved locally installs cleanly in production. Blocked packages still fail fast.
Other strong features:
<ul>
<li><code>phi x</code> (exec) — Much safer <code>npx</code> alternative (fetch + full scan + run)</li>
<li><code>phi create</code> — Scaffolds popular frameworks with Phi’s security pipeline</li>
<li><code>phi audit fix</code> — Smart auto-fixing for typosquats, deprecations, and advisories</li>
<li>Excellent <code>phi why</code> and detailed reporting</li>
</ul>
<h3>Quick Start</h3>
<pre><code># Install Phi
curl -sSL https://phi.philtechs.org/install.sh | sh

# Use it
phi install
phi ci --omit=dev # Production / Docker
phi x cowsay &quot;Hello Phi&quot; # Safer npx
</code></pre>
Website &amp; Docs: <a href="https://phi.philtechs.org" target="_blank" rel="noopener nofollow">https://phi.philtechs.org</a>
GitHub: <a href="https://github.com/philtechs-org/phi" target="_blank" rel="noopener nofollow">https://github.com/philtechs-org/phi</a>

🚀 Daily Open Source Tools Squad delivers daily articles, open-source projects, and technical resources for Developers & DevOps pros. Stay updated with the latest trends & insights!

📬 Join our mailing list! → theinfinity.dev

Daily Open Source Tools

Phi v0.4.1 is a supply chain firewall for npm that intercepts packages before they touch disk. Unlike npm audit, Phi resolves the full dependency tree, downloads tarballs, and scans everything in memory using 13 detectors plus the OSV database, issuing a Block/Review/Install verdict before any code executes. Lifecycle scripts are disabled by default. New in v0.4.1: a dedicated phi ci command for CI/CD environments (Vercel, Railway, GitHub Actions, Docker), a --yes flag for auto-approving reviewed packages, and --omit=dev for skipping devDependencies. Additional features include phi x as a safer npx alternative, phi create for scaffolding frameworks, and phi audit fix for auto-fixing typosquats and advisories. Distributed as a single static Go binary, MIT licensed, with no daemon or telemetry.

Phi: The Install-Time Supply Chain Firewall for npm

Isn’t this already solved with proper package managers like pnpm that can install from lockfile? Not sure why should you use raw npm anymore