targate

targate is a terminal-based security tool that inspects npm packages before their code runs on your machine. It quarantines tarballs, scans lifecycle scripts for suspicious behavior, and applies a deterministic policy to decide whether installation should proceed. The tool checks for risky patterns like environment access, credential theft, and remote payload fetching.

Designed for developers and teams managing npm dependencies, targate operates as a CLI gate in your existing workflow without requiring accounts or dashboards. The maker indicates it was built with Claude Code. AI analysis is optional and can run locally; a deterministic rules engine makes verdicts independently.