pkg.soopen package index

npm / rank 2098

Install lavamoat with npm

lavamoat is a NodeJS runtime where modules are defined in [SES][SesGithub] Compartments. It aims to reduce the risk of malicious code in the app dependency graph, known as "software supply chain attacks". Version 11.1.4 via npm; verified 2026-06-25.

Install commandSecurity notes

install

Additional install commands

Portable and language managers

npmverified · 100%
npm install -g lavamoat

local npm package metadata

overview

Package summary

lavamoat is a NodeJS runtime where modules are defined in [SES][SesGithub] Compartments. It aims to reduce the risk of malicious code in the app dependency graph, known as "software supply chain attacks".

Commands and aliases

  • lavamoat
  • lavamoat-run-command

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for lavamoat. Package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No npm postinstall script is recorded in package metadata.
  • No Homebrew bottle metadata was recorded.
  • Installs with 10 runtime dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
lavamoatcliglobal executable
lavamoat-run-commandcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-04
manager version11.1.4
manager updated2026-06-25
local dataok
upstreamnot checked
latest detectednot detected

https://github.com/LavaMoat/lavamoat

install metadata

Package metadata

Package keynpm:lavamoat
Version11.1.4
Package managernpm
Package manager pagehttps://www.npmjs.com/package/lavamoat
Homepagehttps://github.com/LavaMoat/lavamoat#readme
Repositoryhttps://github.com/LavaMoat/lavamoat
Upstream docshttps://github.com/LavaMoat/lavamoat#readme
LicenseMIT
Source archivehttps://registry.npmjs.org/lavamoat/-/lavamoat-11.1.4.tgz
Issue trackerhttps://github.com/LavaMoat/lavamoat/issues
Last updated2026-06-25T12:03:12.741Z
Published2026-06-25T12:03:12.741Z
Pulseupdated
Dependencies@babel/code-frame, @babel/highlight, @lavamoat/aa, bindings, htmlescape, lavamoat-core, lavamoat-tofu, node-gyp-build, resolve, yargs
Bottlenot recorded
npm postinstallnot defined
Servicenone declared

registry facts

Source database details

Source Databasenpm registry
Dist Tags
Latest
11.1.4
Version Count100
Maintainers
  • kumavis
  • naugtur
  • boneskull
Authorkumavis
PublisherGitHub Actions
Engines
Node
^20.19.0 || ^22.5.1 || ^24.0.0
Integritysha512-YbdH4eJkC7clqdU2xd3byorMyMpU5OigtU5kf9Gjcg0O+unLeIZ6Ct6sM/k19rBbEwo2/k/JtfpWXqaaxmTI4A==
Shasum53d56ddac60b127e210820972bef0027ec1cfe59
Unpacked Size84,053
File Count0
Created At2020-03-27T04:53:19.858Z
Latest Published At2026-06-25T12:03:12.741Z
Modified At2026-06-25T12:03:13.056Z

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Same workflow

  • lavamoat-coreSecurity-sensitive metadata or terminology overlaps. Shared terms: babel, chain, cli, core, dependencies.
  • lockfile-lintSecurity-sensitive metadata or terminology overlaps. Shared terms: chain, cli, security, supply, supply-chain-security.
  • vm2Both packages touch the same language runtime or ecosystem. Shared terms: cli, code, is, modules, node.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • cross-ecosystem install command graph
  • package relationship graph
  • package version freshness
  • package-page enrichment
  • pkg.so package database
  • pkgdb category and tag curation