Ward: Open-source tool intercepts npm installs to block supply chain attacks for Claude Code users
Ward is an open-source security tool built by Vanguard Defense Solutions after the [email protected] compromise incident. It hooks into your package manager and checks every package before install scripts execute.
When Claude Code runs npm install on your behalf, Ward automatically screens packages. The tool includes a Claude Code hook that intercepts every install command before execution, eliminating the need for manual intervention.
Key features
- Blocks known malware packages
- Detects typosquats (warns when packages like "axxios" resemble legitimate packages like "axios")
- Flags suspicious install scripts
- Identifies version anomalies
- Ships with 42 verified real-world attack patterns
Example output
$ npm install [email protected]
✗ ward: BLOCKED
This version steals SSH keys and cloud credentials
Safe version: 1.14.0Installation
npm install -g wardshield
ward initThe tool is MIT licensed and includes 286 tests. It was developed specifically for the Claude Code community following supply chain attack concerns.
Additional resources include a live threat feed at wardshield.com and the GitHub repository at Vanguard-Defense-Solutions/ward.
📖 Read the full source: r/ClaudeAI
👀 See Also
Security Alert for Local OpenClaw Instances Without Sandboxing
A Reddit post warns that running vanilla OpenClaw instances locally without proper isolation can lead to exposed API keys, accidental file deletion, and data leaks. The source recommends sandboxing bash tools or using a managed service.
Claude Code Security Plugin: Pushing AppSec into the Developer Workflow
Anthropic shipped a security-guidance plugin for Claude Code that identifies and fixes vulnerabilities during coding. Available to all users via the plugin marketplace, not just Enterprise. Discusses whether this becomes a lightweight assistant, serious AppSec layer, or bridge to Claude Security.
VulnHunter: Capital One's Agentic AI Code Security Tool Now Open Source
Capital One open-sourced VulnHunter, an agentic AI tool that simulates attacker entry points, falsifies findings to cut false positives, and generates targeted code fixes.
McpVanguard: Open-source security proxy for MCP-based AI agents
McpVanguard is a 3-layer security proxy and firewall that sits between AI agents and MCP tools, adding protection against prompt injection, path traversal, and other attacks with about 16ms latency.