Automatic protection
Protect yourself every day without thinking about it.
On this page
`forkguard setup` adds a small, clearly marked block to your shell profile. It wraps npm, pnpm, yarn, bun and git. For package managers it checks before the command runs, and can stop it. For git it checks after, and warns you.
- You type
npm install. - Your shell runs forkguard first.
- Clean, or only MED: the command runs. HIGH: it is stopped, with the reason.
#Turn it on
npm install -g forkguard
forkguard setupPress Enter to also stop VS Code from running tasks by itself. Then close your terminal and open a new one.
#Which commands are checked
| Tool | Subcommands that trigger a check |
|---|---|
npm | install, i, ci, add, run, run-script, dev, start, build, test, exec, x, rebuild |
pnpm | install, i, add, run, dev, start, build, test, exec, dlx |
yarn | plain yarn, install, add, run, dev, start, build, test, dlx |
bun | install, i, add, run, dev, start, build, test, x |
git | clone, pull, merge, checkout, switch (checked afterwards; warns, never stops) |
Anything else, such as npm --version, npm publish or git status, runs normally with no check. npx is not wrapped.
#What you see
| Project state | What happens |
|---|---|
| Clean | Nothing. No output at all. |
| Only MED findings | A one-line note: “forkguard: N thing(s) worth a look in my-app. Run "forkguard" for details.” The command runs. |
| Something HIGH | The findings are printed and the command is stopped: “Stopped "npm install" so nothing in this project runs.” |
After git clone or pull, something HIGH | The findings are printed with “The code you just pulled in is infected. Clean it before you open or install it.” The git command had already finished. |
#When the check is skipped
- Global installs (
-g,--global,--location=global). They run that package’s own scripts, not the project you happen to be in. - Outside a project. There is no
package.jsonabove you, so there is nothing to protect. - `FORKGUARD_SKIP=1`. Your explicit choice, for one command.
#It checks the project you mean
Options that take a value are understood, so they are not mistaken for the subcommand, and options that choose the project are followed:
npm --prefix ./app install # checks ./app
pnpm -C ./app install # checks ./app
yarn --cwd ./app install # checks ./app#It fails open
The hook never breaks your tools. Only an explicit “infected” answer (exit code 1) stops a command. If forkguard is missing (you switched Node version with nvm, or uninstalled it) or crashes, your command runs anyway.
#Run something anyway, once
FORKGUARD_SKIP=1 npm install$env:FORKGUARD_SKIP='1'; npm install#Turn it off
forkguard setup --removeOpen a new terminal and it is gone. The hook is plain shell code between # >>> forkguard >>> and # <<< forkguard <<< in your profile, so you can read it or delete it by hand.