I built a Claude Code plugin that blocks compromised packages before installation

Last week, [email protected] was hijacked on npm. A few days before that, [email protected] on PyPI. Both were compromised versions published through hijacked maintainer accounts. Claude Code would have installed both of them as it doesn't ask any questions. AI coding agents run npm install and pip install on your behalf, and there's nothing checking whether the package is safe before it executes. By the time you notice, the compromised code has already run. So I built attach-guard — an open source Claude Code plugin that intercepts every package install command and evaluates it against supply chain risk data before execution. How it works attach-guard uses Claude Code's PreToolUse hooks. This is important, it's not a skill (which Claude can choose to ignore) or an MCP server (which is advisory). Hooks run automatically on every matching tool call. Claude cannot skip or override them. When Claude runs npm install axios, attach-guard: Intercepts the command before it executes Scores the package