# Install depsguard with Homebrew, winget Harden package manager configs against supply chain attacks. Version 0.1.40 via Homebrew; verified 2026-06-30. Also installable with winget: winget install --id Arnica.DepsGuard -e. ## Install ```sh sudo av install brew:depsguard ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install depsguard ``` Evidence: local Homebrew formula metadata ### Windows - winget (92%): ```sh winget install --id Arnica.DepsGuard -e ``` Evidence: Windows Package Manager source index: Arnica.DepsGuard from https://cdn.winget.microsoft.com/cache/source.msix ## Package facts - **Package key:** brew:depsguard - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.1.40 - **Source summary:** Harden package manager configs against supply chain attacks - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** MIT - **Source archive:** - **Last updated:** 2026-06-30T21:29:11Z - **Generated:** 2026-07-25T07:20:51+00:00 ## Executables - depsguard (cli) - depsguard (alias) ## Build dependencies - rust ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-25 - Package-manager version: 0.1.40 - Package-manager updated: 2026-06-30 - Local data: ok - Upstream repository: https://github.com/arnica/depsguard - Upstream latest detected: v0.1.40 (current) ## Project history and usage DepsGuard is a young supply-chain hardening CLI that scans package-manager and dependency-bot configuration files for safer defaults. It focuses on release cooldowns, install-script risk, provenance-related settings, and other package-manager knobs that reduce exposure to dependency confusion and malicious fresh releases. ### Project history The official arnica/depsguard repository was created in 2026. The README presents DepsGuard as a single static Rust binary with no third-party Rust crate dependencies, built to scan npm, pnpm, yarn, bun, uv, pip, poetry, aube, Renovate, and Dependabot configs. The project website and README emphasize interactive scanning and fixing: DepsGuard reads known config locations, compares settings to recommended supply-chain defaults, previews diffs, writes backups, and can restore changes. ### Adoption history Because DepsGuard is new, its official adoption record is still mostly packaging and distribution: prebuilt GitHub release binaries, Homebrew core, APT setup, crates.io, WinGet, and Scoop. That packaging breadth suggests the tool is meant for developer workstations as much as CI hardening checks. ### How it is used Users can run `depsguard` for an interactive TUI, `depsguard scan` for read-only reporting, or `depsguard restore` to roll back from backups. The tool searches user-level and repo-level package-manager configuration files, including `.github/dependabot.yml` and Renovate files, and only edits files after user approval. ### Why package nerds care For package nerds, DepsGuard is notable because it packages a cross-ecosystem security checklist into one binary. Its config table is a snapshot of how many different package managers have grown similar but incompatible concepts for cooldowns, script blocking, trust policy, and registry hardening. ### Timeline - 2026: Official arnica/depsguard repository created. - 2026: README documents Homebrew core, APT, crates.io, WinGet, and Scoop installation channels. - 2026: Website describes DepsGuard as a one-command scanner and fixer for package-manager security settings. ### Related projects - Related configuration surfaces include npm, pnpm, Yarn, Bun, uv, pip, Poetry, aube, Renovate, and Dependabot. ### Sources - - - ## Security Notes No matching local secret-handling manifest was found for depsguard. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Linux: ~/.npmrc, ~/.config/pnpm/rc, ~/.config/pnpm/config.yaml, ~/.yarnrc.yml, $XDG_CONFIG_HOME/.bunfig.toml, ~/.config/uv/uv.toml, ~/.config/pip/pip.conf, ~/.config/pypoetry/config.toml - macOS: ~/.npmrc, ~/Library/Preferences/pnpm/rc, ~/Library/Preferences/pnpm/config.yaml, ~/.yarnrc.yml, ~/.bunfig.toml, ~/.config/uv/uv.toml, ~/Library/Application Support/pip/pip.conf, ~/Library/Application Support/pypoetry/config.toml - Windows: %LOCALAPPDATA%\pnpm\config\rc, %LOCALAPPDATA%\pnpm\config\config.yaml, %APPDATA%\uv\uv.toml, %APPDATA%\pip\pip.ini, %APPDATA%\pypoetry\config.toml ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** depsguard - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - winget - Arnica.DepsGuard: normalized package name match | Windows Package Manager source index: Arnica.DepsGuard from https://cdn.winget.microsoft.com/cache/source.msix ## Related links - [Package publisher tools](https://www.automicvault.com/pkg/package-publishers/) - Belongs to a package publishing or registry command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [rust](https://www.automicvault.com/pkg/brew/rust/) - Build dependency declared by Homebrew. - [bumblebee](https://www.automicvault.com/pkg/brew/bumblebee/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [chain-bench](https://www.automicvault.com/pkg/brew/chain-bench/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [malcontent](https://www.automicvault.com/pkg/brew/malcontent/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [minder](https://www.automicvault.com/pkg/brew/minder/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [sh4d0wup](https://www.automicvault.com/pkg/brew/sh4d0wup/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [slsa-verifier](https://www.automicvault.com/pkg/brew/slsa-verifier/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [bagel](https://www.automicvault.com/pkg/brew/bagel/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [bomctl](https://www.automicvault.com/pkg/brew/bomctl/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [lavamoat](https://www.automicvault.com/pkg/npm/lavamoat/) - Security-sensitive metadata or terminology overlaps. Shared terms: attacks, chain, cli, dependency, security. ## Combined YAML source View the package source record on GitHub. [combined/depsguard.yml](https://github.com/automic-vault/db/blob/main/combined/depsguard.yml) ## Sources - Nucleus package database - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph