Letting every developer install any package is a policy decision, even if nobody made it on purpose. Open Source Manager is Safeguard's way to make it deliberately.
What it is
The page describes OSM as a curated package registry and install gate that curates, gates, mirrors and monitors open source use. Features listed:
- An approved package registry across npm, PyPI, Maven, NuGet, Crates and RubyGems.
- A license risk engine with permissive, weak copyleft, strong copyleft and proprietary conflict buckets, and gates that fail or warn.
- Maintainer health scoring: bus factor, commit cadence, single maintainer flags and ownership transfers.
- A blocker for typosquats and dependency confusion.
- An internal mirror that runs each resolve through policy.
- Drift alerts for silent upgrades, maintainer changes and new CVEs.
- An audit log of each resolve, decision and source with developer identity.
A separate Gold catalogue of pre-certified packages and images is described as rolling out in early access.
How to use it
- Mirror one registry and run in warn mode.
- Read which packages the license and maintainer rules flag.
- Decide the buckets you will block, and who can grant an exception.
- Review the audit log monthly.
What to verify
The page gives headline zero CVE language for Gold items but also says designed to, and it does not publish the method or the re-certification cadence. Ask before you quote it.
Quick check
What does the audit log record?
Each resolve, decision and source, with developer identity.
