Before you run an install command, look the package up in your browser: confirm the exact name, check for known CVEs, and see who maintains it. It takes under a minute. A lookup extension can do the first two checks for you while you read the registry page.
Why check first
Most dependency problems begin with an install command typed from memory, a blog snippet or an AI suggestion. Misspelled and invented names are a known route for attacks. A pause before install is cheap, and it is the only point where you can stop a bad package before it runs install scripts.
The one minute routine
- Read the name letter by letter. Compare it with the project's own documentation, not a search result.
- Open the registry page. Look at the publisher, the release history and the repository link. A brand new package with a familiar sounding name deserves suspicion.
- Check known vulnerabilities. Look up the package version you intend to install for published CVEs.
- Check the repository. Does the linked source exist, and does it match the package?
- Decide the version. Pin an exact version rather than taking whatever is latest.
Doing steps 3 and 4 faster
The Safeguard download page lists Gold Open Source, a free Chrome extension that works as a launcher for gold.safeguard.sh. It needs no account, and it looks up packages, CVEs, models and MCP servers. The page says it never reads page content. It reads the current tab's address on npm, PyPI, GitHub and seven other package sites only if you enable that option.
That last point is worth using as a template for judging any lookup extension. The right design reads as little as it can, and makes the broader behavior opt in.
Click through it at your own pace, or open it full screen.
What a lookup does not replace
Keep the habit short enough that you will actually do it. A routine that takes ten minutes gets skipped by Friday. One that takes a minute and catches a misspelled name once a quarter pays for itself.
- A clean lookup means no known issue, not no issue. New malicious packages may not be listed yet.
- Direct dependencies are only part of the picture. The packages they pull in need inventory too.
- A pre install check is one habit. A pipeline check on every pull request catches what individuals skip.
For the pipeline side, Safeguard offers SBOM and dependency scanning, and a free scan.
Quick check
Is the latest version always safest?
Not necessarily. Newer versions may contain a compromised release, and older ones may carry known CVEs. Check the release history and pin deliberately.
Does the extension see every page I visit?
According to the download page, Gold never reads page content, and reads the current tab address on package sites only if you enable that option. Review the permissions on the store listing yourself before you install.
Sources
Last reviewed: 19 October 2026.
