Install Gate: hold fresh npm versions after the Zod scare
A CLI and GitHub App that holds back newly published package versions before agents or CI install them. Small dev teams pay.
Crowded · Suspected Zod 4.6.6 malware compromise
Written for: Solo builder
Next step
This week, ship `npx install-gate` with a 72-hour age hold and an install-script diff, run it against the Zod 4.6.6 tarball as a public demo, and post the write-up in the HN Zod thread and r/javascript.
Why now
The earlier Install Gate card argued from general risk. Now there is a concrete incident on one of the most-installed packages in the JS ecosystem. Separately, HN is angry that Codex CLI installs a persistent, self-updating background daemon by default. Developers are asking two questions at once: what are my tools installing, and what are they leaving running? Coding agents install dependencies on their own, so a 48 to 72 hour hold on fresh versions plus a diff of install scripts is a cheap guard that most teams still don't have.
What became possible
Nothing new technically. What changed is the threat: an HN thread reports a suspected malware compromise of Zod 4.6.6. Zod is a validation library in most TypeScript stacks, so a poisoned release reaches anyone whose coding agent runs npm install without a human watching.
Three ways in
- install-gate CLI
Wraps npm, pnpm and bun. It blocks any version younger than a set age (72h by default) and diffs the new tarball against the previous one for new install scripts, network calls, obfuscated blobs and new binaries. Exits non-zero so the agent's install fails loudly.
- Customer
- Solo devs and 2-20 person teams running Claude Code, Codex or Cursor agents
- Model
- Free open-source CLI. $15/month per org for a hosted allowlist, team policy and Slack alerts
- Footprint
A `footprint scan` command that lists the daemons, launch agents, systemd units, cron entries and shell-rc hooks added by AI CLIs, with one-command disable. It starts with the Codex daemon case.
- Customer
- Developers who install several AI coding tools
- Model
- Free CLI as a funnel into Install Gate paid seats
- Dependabot diff commenter
A GitHub App that comments on Renovate and Dependabot PRs with a risk summary of the tarball diff and holds merge until the version passes the age threshold.
- Customer
- Small SaaS teams with auto-merge turned on
- Model
- Free for public repos, $9/month per private org
Competition
One more caveat: I could not confirm a compromise of the main zod package itself. Searches turned up the @tanstack/zod-adapter compromise from the Mini Shai-Hulud campaign and several zod lookalike malware packages. The "Zod scare" framing should be checked before using it in marketing.
Full competition notes (10 competitors)
The age-gate idea is already taken. Since 2025 to 2026, npm, pnpm (24h by default in v11), Yarn and Bun all ship a native minimum release age setting, and so do Dependabot (cooldown), Renovate (minimumReleaseAge) and the major registries (JFrog, Cloudsmith, CodeArtifact). Aikido Safe Chain is free, open source, wraps every major package manager and is pitched for AI agents. Socket covers the network-firewall and PR-comment side. A paid tool sold to small teams for "block versions younger than 72h" would be competing with free defaults. The diff feature is narrower and less covered: a transparent, local, deterministic diff of the new tarball against the previous version that flags new install scripts, network calls, obfuscated blobs and binaries, without needing a vendor threat feed. Socket and Aikido flag these as alerts from their own intel, but a self-hostable open-source differ with an explanation the agent can read might find a niche. Even so, it is hard to charge for, and Socket could ship it as a feature. Footprint is the emptiest of the three ideas. I found no tool that audits the daemons, launch agents, systemd units, cron entries and shell-rc hooks that AI coding CLIs install, and the Codex persistent-mode coverage shows people are paying attention to this. But it reads as a free open-source utility or a feature inside an endpoint security product, not a paid product on its own. One more caveat: I could not confirm a compromise of the main zod package itself. Searches turned up the @tanstack/zod-adapter compromise from the Mini Shai-Hulud campaign and several zod lookalike malware packages. The "Zod scare" framing should be checked before using it in marketing.
- npm CLI min-release-age
Reported to have shipped in npm 11.10.0 (Feb 2026) as a native minimum package age setting. It is off by default. This makes the age-gate part of the CLI something npm users get for free.
- pnpm minimumReleaseAge (default 24h in pnpm 11)
Added in pnpm 10.16. pnpm 11, released in May 2026, turns it on by default at 24 hours.
- Yarn Berry npmMinimalAgeGate
Yarn has a native age gate, reportedly defaulting to one day. A gist notes a parsing bug where day-suffix values like '7d' were silently ignored.
- Aikido Safe Chain
A free, open-source local proxy that wraps npm, npx, yarn, pnpm, bun, pip, uv and others. It holds back npm versions published within the last 24 to 48 hours (the README has said both) and checks them against Aikido's malware intelligence. Aikido markets it explicitly for installs triggered by CI and AI coding agents. This is almost exactly install-gate, minus the local tarball diff.
- Socket (Socket Firewall and GitHub App)
Socket Firewall blocks unsafe package fetches at the network level, aimed at coding agents. Replit uses it as the backend of its package firewall. Socket's GitHub App already comments on dependency-update PRs, flagging things like new install scripts. Socket is well funded and covers most of the Dependabot diff commenter idea.
- Dependabot cooldown
Native minimum package age for Dependabot PRs, with separate settings per semver level. Third-party posts say a 3-day default applied from July 2026, which I could not confirm in GitHub's own changelog.
- Mend Renovate minimumReleaseAge
Renovate enforces a 3-day minimum release age for anyone using its best-practices config. That covers the hold-merge-until-age part of the GitHub App idea.
- JFrog Artifactory, Cloudsmith and AWS CodeArtifact age gating
Registry-side cooldown policies from enterprise artifact registries. JFrog applies a 24-hour default. Cloudsmith has package cooldown policies (https://cloudsmith.com/product/package-cooldown-policies.md).
- gestate
A small open-source tool that sets a minimum release age across local package managers, including npm.
- Forgeterm
A Linux daemon that finds installed AI coding tools by scanning /proc and logs what they do. It is only next door to Footprint. I found no tool that lists the launch agents, systemd units, cron entries and rc hooks that AI CLIs install.
Checked 2026-10-13
Risks
- Crowded: Socket and similar supply-chain scanners already sell tarball analysis, so the wedge has to be agent-first and simpler
- Package managers are adding native minimum-release-age settings, which could make the core feature a config line
- The Zod report is unconfirmed in today's evidence, so the urgency may fade if it turns out to be a false alarm
Strong tech readiness and team fit; open space is the weak point (4).
tech 9 · pull 6 · space 4 · fit 9 · build 9
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
What happened next
- +7d · 20 Oct 2026 nothing yet. No confirmed launches, funding rounds, acquisitions, or significant press coverage of Install Gate or directly equivalent products occurred after the October 13, 2026 flag date. While several npm agent security tools exist (slopgate-cli, AgentGate, AgentAudit, AgentGuard), none have verified publication dates after October 13, 2026. The search window is also narrow at seven days.
Status history
- 2026-10-13 Flagged as buildable