17 Jun 2026

This post is an expansion of what I wrote on r/archlinux as a proposal for AUR helpers. It is a call for every package manager to add support for global hooks.

The packaging ecosystems that we all rely on have been under constant attacks. The most interesting countermeasures currently are: Dependency Cooldowns, and Dependency Policies. A third interesting one is Homebrew’s cooldown which is a 1 day wait before they automatically bump a package from Python/NPM ecosystems.

In addition, almost every security vendor now has a package management “firewall” offering (Socket, Datadog, Safedep for eg). The various ways this can work is:

1. Registry mode, where you can point your package manager at a local registry and it proxies requests, blocking access wherever it deems fit.
2. Shell wrapper, where you alias your package manager and it intercepts your commands. Shell aliases are a very weak security boundary.
3. MITM mode, where you configure it as a HTTPS Proxy and it intercepts your network traffic.

I don’t like any of these. All of the above depend heavily on either the Registry APIs, or the command schema. I also don’t like mechanisms that require any additional infra (such as a hosted pass-through registry that scans stuff), since it is additional infrastructure only accessible to companies and not individual developers.

My radical package-manager idea is this: every package manager should support global hooks. Cooldowns and Policies are just implementation details that a decent hook system should already allow you to do. What I mean by a global hook is: Code configured globally that runs before various stages in your package manager’s workflow. This is different from “local package hooks” - package-specific code that runs during/before/after your package gets installed.

I built a Dependency Policy proof-of-concept using the StepSecurity OSS Feed and pnpm’s hook system. Every package install is checked against the threat feed and it raises an exception if we find something malicious being installed. Unfortunately:

• pnpm’s hooks are on a per-workspace basis. This means you can’t run them for global installs, or configure them globally.
• NPM does not support hooks.
• Yarn has a hook API that yarn plugins can use, but I’m not sure if you can configure it globally.

But moving across to other package managers, the same system can help us deal with problems. An AUR helper can add hook-scripts, and you can configure your own threat-feed or malware scanner as a hook in the PreClone or PreBuild stage. More importantly - a hook doesn’t have to be a package, and it should be treated as global configuration.

We shouldn’t have to reinvent every defensive feature in every package manager. Ask your package manager to support global hooks instead:

• Feature request for pnpm
• Relevant issue for uv
• Paru already supports a PreBuild hook.
• yay’s hook system got an upgrade for an UpgradeSelect event where you can do cooldown checks. This should be extendable to threat-feeds quite easily.
• (Comment to add more here).

Published on June 17, 2026