Stop your AI coding agent from installing malware
Coding agents run npm install, pip install and curl … | sh on their own, and sometimes pick a package name that does not exist or one that only looks like a popular one. Attackers publish malware under exactly those names. With Safe Install, Scopebond checks each install before it runs, in Claude Code, Cursor, Codex and GitHub Copilot. It blocks known malware, package names that do not exist and look-alike names, asks you first about very new packages and scripts from sites it does not know, and lets everything else install as usual. Safe Install is part of every Scopebond Cloud plan, Free included.
1. Connect your computer to Scopebond Cloud
Safe Install works on computers connected to a Scopebond Cloud workspace. On Windows, install Scopebond for Windows, the signed installer on your workspace's Connect page. On macOS and Linux, one command sets up the Scopebond Agent and the hook for your coding tools and connects them:
npx -y @scopebond/agent@latest setup https://cloud.scopebond.com2. What Safe Install blocks
- Known malware. Packages listed as malware in the OpenSSF malicious packages list or the OSV database, for npm, PyPI, crates.io, Go and RubyGems, and npm names removed for security reasons.
- Made-up package names. A name that does not exist on the public npm or PyPI registry. AI tools sometimes invent names, and attackers register them.
- Look-alike names. A near copy of a popular package (a swapped, missing or doubled letter) that almost nobody uses.
3. What it asks you about
- A package or version published in the last 7 days.
- A package with very few downloads, or one that runs its own scripts when it is installed and is not widely used.
- A version published by someone who published none of the earlier versions, or that lost the build provenance its previous version had.
- A name very close to a popular package, a scoped npm name that is not on the public registry, or a package from a registry other than the public one.
- A script or program downloaded from a site Scopebond does not know as an official download site (
curl … | sh).
4. How you approve an install
When Safe Install asks, your coding tool shows its own prompt with the reason in plain words, and you decide: Claude Code (in a mode that asks before it acts), Cursor and GitHub Copilot ask you there. Where the coding tool cannot ask (Codex, or Claude Code in a mode that never asks), the install is stopped with the reason, and you can run it yourself in your own terminal once you have checked it. When your company asks an admin to approve each new package, the request appears in the workspace, and once it is approved the package installs on every computer. A block names what was blocked and why, for example that the package is listed as malware or that the name does not exist.
5. What happens offline
Your computer keeps a signed list of known malware from Scopebond Cloud and checks it for updates every six hours while it is connected. When the workspace cannot be reached, that list still blocks known malware, packages it already checked keep their answer, a package published in the last 7 days is asked about, and any other package is asked about too. Every check is signed into the install's record.
6. Set your company's rules
In your workspace, owners and admins choose the registries and mirrors your agents may install from, a minimum age for new releases, whether an admin approves each new package, and packages to always allow or always block. A blocked package is stopped on every computer, also offline. Every install is listed in the workspace's Activity, with what Safe Install said about it.
What this does not do
Safe Install checks installs a coding agent runs through its tools: package managers (npm, pnpm, Yarn, Bun, npx, pip, uv, Poetry, pipx, Cargo, Go, RubyGems) and scripts or programs downloaded and run. It does not scan the code inside a package, and it does not check installs a person runs outside the coding agent.
Alternatives
- npm audit and similar tools — report known vulnerabilities in packages you already installed; Safe Install checks a package before the agent installs it.
- Reviewing every install by hand — works for one person; Safe Install applies the same checks to every agent on every computer.
FAQ
Which coding tools does Safe Install work with?
Claude Code, Cursor, Codex and GitHub Copilot, on computers connected to a Scopebond Cloud workspace.
Which package managers are checked?
npm, pnpm, Yarn, Bun and npx; pip, uv, Poetry and pipx; Cargo, Go and RubyGems; and scripts or programs downloaded and run with curl or wget. Malware lists cover npm, PyPI, crates.io, Go and RubyGems; package details such as age and downloads are checked for npm and PyPI.
Does Safe Install slow my agent down?
A checked package is answered from the workspace's cache in well under a second, and a hook never waits more than 2 seconds for an answer: when no answer arrives in time, the offline rules apply.
Which plans include Safe Install?
Every Scopebond Cloud plan, including Free.
What does Scopebond learn about my packages?
The name, version and download site of each install, never your code or files. Each check is kept in your workspace's records.
Last verified 2026-10-18. Commands are covered by the public repo's tests (packages/hook/test/install-verdicts.test.mjs).