How do you check a package before install in the Safeguard desktop app?

In the Safeguard desktop app (early access beta), you can check a package before it touches your machine: look it up in the search window, read its registry metadata in the Terminal tab, add it to the lockfile only on a throwaway branch, run a scan on the folder, and decide. Nothing installs until you say so.

What does the desktop app give you here?

The desktop app is an Electron application for macOS, Windows and Linux, in early access, so features can change. One window holds two views: the Safeguard web app on the left, about three quarters of the width, and a local panel on the right with tabs for Scan, Terminal, MCP, Tasks, Files and Settings.

Three parts matter for this job. The web view gives you search. The Terminal tab runs a fixed list of commands, including npm, git and safeguard, only inside folders you have granted. The Scan tab runs vulnerability scans on a granted local folder and groups results by severity.

How do you run the check?

Step 1. Grant the folder and branch. In the Files tab, grant the project folder. In the Terminal tab, run git switch -c try/new-package. This branch is your sandbox, and you can delete it if the package fails the check.

Step 2. Look it up. In the web view, use global search with the package name. The docs say plain text such as a package name or a CVE ID works. Read what comes back before going further.

Step 3. Read the registry record. In the Terminal tab, run npm view package-name and look at the maintainers, repository link and last publish time. A very new version of an old package, or a repository field that does not match the project you expected, deserves a pause. To see install-time scripts, run npm view package-name scripts. An install or postinstall script is not proof of anything bad, and it is a reason to read what it does.

Step 4. Preview without installing. npm install package-name --dry-run reports what an install would do without installing anything, per npm's documentation. To see the full dependency tree this package would add, use npm install package-name --package-lock-only, which updates only the lockfile and does not download dependencies into node_modules. Because it also changes package.json, do it on the branch from step 1.

Step 5. Scan the folder. Open the Scan tab and run a full scan on the project. Compare the severity groups with what you had before. The docs say scanning can fall back to manifest-based analysis if the bundled command line binary is missing for your platform, which suits this check, since the manifest and lockfile already describe the new tree.

Step 6. Decide. If new critical or high findings appear, or the registry record looks wrong, delete the branch with git switch - then git branch -D try/new-package. If it looks fine, install for real, preferably with scripts turned off first using npm install package-name --ignore-scripts, then run your tests.

What are the limits?

This is a pre-install check, and it is not a guarantee. The documented output of the Scan tab is vulnerability findings grouped by severity. We did not find documentation that the desktop scan flags a freshly published malicious package, so treat it as one signal alongside registry metadata and your own reading.

The terminal cannot run commands outside its allowlist, and it only works in folders you have granted. That helps safety and may block some custom tooling.

Because the app is in beta, check the in-app behavior against this walkthrough.

What to do

1. Grant only the project folder you are working in.
2. Create a throwaway branch before testing any new package.
3. Search for the package in the web view and read the result.
4. Check registry metadata and any install scripts with npm view.
5. Preview with --dry-run or --package-lock-only.
6. Scan, compare, then keep or delete the branch.
7. Install with scripts off the first time, then run your test suite.

Quick check

Sources

• Safeguard docs: Desktop Application, fetched 18 October 2026
• Safeguard docs: Web Application, fetched 18 October 2026
• npm Docs: npm install
• npm Docs: npm view
• npm Docs: config (ignore-scripts)

Last reviewed: 18 October 2026.