Make package install safe by default
~/.shim/bin
Joined June 2026
- Tweets15
- Following1
- Followers2
- Likes10
We wrote this in June.
7 weeks later, npm just proved it:
440+ packages compromised. Credentials stolen. IDEs backdoored. All from a single `npm install`.
This isn't a hypothetical anymore. Here's what happened 👇
This is exactly the blind spot we built Shim for.
Anomalous preinstall scripts. Sudden publish spikes from a maintainer. Credential-scope changes. These are catchable signals — before install, not after your CI secrets are gone.
We flag them early.
If your team is still finding out about attacks like this from a blog post after the fact, that's the gap we're closing.
Link in bio to see how Shim catches this stuff in real time. getshim.app
Shim Security retweeted
Make npm install safe by default!
Launching SHIM: getshim.app
-> lock your versions. npm i rewrites your lockfile silently. use npm ci instead - it respects exactly what's locked and fails if there's a mismatch. this alone has saved me from shipping broken builds at 2am.
and honestly? all of this is mental overhead that shouldn't exist. that's why we built getshim.app and it makes package install safe by default!
don't be paranoid about `npm i` and just install shim! getshim.app
-> maintainer activity tells you more than stars ever will. stale repo with 3 open PRs from 2019? red flag. active discussions, recent commits, responsive issue triage; that's the green zone.
-> audit the dependency tree. don't just check the top-level package. run npm ls and do the same sniff test on its children. a sketchy transitive dep is still your sketchy dep.
helloww, junior devs, listen up!
npm packages are a minefield and nobody teaches you this stuff
thread 🧵👇
