You can check a package before you install it by opening the Gold Open Source Chrome extension, searching the package name in its side panel, and reading its CVE count, health grade and supply chain notes. Do that before you run the install command. It takes under a minute and catches the obvious problems.
What does the extension actually show you?
The Chrome Web Store listing describes Gold Open Source Intelligence as a way to "search the Safeguard Gold catalog from your side panel: zero-CVE packages, CVEs, health grades and supply-chain intelligence." The Gold directory behind it is free and needs no login.
The directory covers many ecosystems, including npm, PyPI, Maven, Go and Cargo. For each package you can expect to see known vulnerabilities, license, available versions and a health signal. Treat the extension as a fast lookup, not a verdict. It tells you what is known about a package. It does not read your code.
There is also a separate Safeguard extension that opens the Griffin search panel for questions in plain language. Use the Gold extension for a quick package lookup and the Safeguard extension when you want to ask follow-up questions.
What is the pre-install routine?
Keep it the same every time, so it becomes a habit rather than a decision.
First, confirm the name. Typosquats work because people type fast. Compare the spelling against the project's own documentation or repository, not against a search result.
Second, open the extension and search that exact name. Check that the ecosystem matches. A package called the same thing can exist on npm and PyPI and be unrelated.
Third, read the version list. Note whether the version you plan to pin has known vulnerabilities and whether a fixed version exists. The lookup is most useful when it points you to a safer version before you commit to one.
Fourth, look at health signals: how recently the package was released, whether a maintainer is active, and whether the license fits your policy.
Fifth, decide. Install, install a different version, or find an alternative.
What will this not catch?
A browser lookup works from published data. It will not catch a brand new malicious release that nobody has reported yet. It also does not know how your application calls the library, so a listed CVE may or may not matter to you. Reachability analysis answers that second question once the package is in your project, and a scan of your lockfile answers it for everything else you already depend on.
For the package you are about to add, the lookup is the cheap first filter. For the hundreds you already have, use a scan.
What to do
- Install the Gold Open Source extension from the Chrome Web Store and pin it to the toolbar.
- Before every new dependency, search its exact name and confirm the ecosystem.
- Pin a version that the lookup shows as free of known vulnerabilities, or note the fixed version to move to.
- Write down why you chose the package in the pull request description, so a reviewer can repeat your check.
- Scan the full project afterward. The free in-browser scan at gold.safeguard.sh/scan takes up to 100 dependencies and needs no install.
- For team policy, move the check into CI so it does not depend on one person remembering.
Quick check
Does the extension scan my code?
No. It looks up packages in the Gold catalog. To check what your own project uses, run a scan of the dependency list or use the free in-browser scan.
Is a clean lookup proof that a package is safe?
No. It means nothing is known today. New malicious releases can appear before anyone reports them, so keep scanning after install.
Sources
- Gold Open Source Intelligence on the Chrome Web Store, fetched 18 October 2026
- Gold Open Source directory, fetched 18 October 2026
- Safeguard docs: Browser Extension, fetched 18 October 2026
Last reviewed: 18 October 2026.
