How is this different from pip-audit or composer audit?

Those are post-install audits — they run after a package's code is already on disk (and may have run). A 5bats gate checks before the install, across the whole dependency tree, and holds back releases too new to have been vetted.

Do the gates make outbound calls?

They query public vulnerability feeds (OSV, advisory databases) to check a package — that is the job — but they send no telemetry and keep no account. The check runs locally and fails closed when a feed is unreachable.

Why is there no npm gate?

By design. pnpm ships a built-in minimum-release-age setting and there are solid existing tools for npm, so 5bats does not reinvent that. The gates focus on pip, Composer, Homebrew and AI coding assistants.

Supply-chain gates

pip install, composer install and brew upgrade run a package’s own code during installation — so a malicious package executes the moment it lands, before any post-install audit can look. These gates move the check to before the install.

Why this matters

Attackers exploit that install-time execution constantly — typosquats, hijacked maintainer accounts, and zero-day malicious releases that land and get downloaded for hours before any database flags them. OWASP ranks vulnerable and outdated components as A06 in its Top 10, and the most dangerous window is the first hours after a bad version ships — exactly when no advisory has indexed it yet, so a post-install audit can’t help.

Two May 2026 incidents make it concrete (as reported): in Laravel-Lang, attackers with stolen credentials pushed malicious releases across roughly 700 versions in minutes, executing through Composer’s post-install hooks before composer audit could flag them; in TrapDoor (The Hacker News ), 34+ packages across PyPI, npm and Crates.io auto-executed on import to steal SSH keys and credentials — and every PyPI package was under 72 hours old when reported, so a freshness hold alone would have blocked them, no CVE required.

The gates below run that check before the install — across the whole dependency tree, holding back releases too new to trust, and failing closed when something can’t be verified.

→ Full explainer: What is a software supply chain attack? — how it works, the attack types, the freshness window, and how to defend.

Further reading: OWASP — A06: Vulnerable & Outdated Components · TrapDoor (The Hacker News ) · Laravel-Lang Packagist compromise (alert ).

The check moves before the install: a malicious or too-fresh package never reaches your machine.

The tools

pip-cve-gate

Every pip install can pull in code that runs the moment it lands — and a brand-new malicious package usually arrives before any security database has caught up. pip-cve-gate checks the whole dependency tree first and holds back releases too new to trust, so the bad one never gets the chance to run.

Learn more about pip-cve-gate →

composer-cve-gate

Composer runs a package’s own scripts during install, so a malicious PHP package executes before you ever see it. composer-cve-gate checks the full lockfile before composer install runs and blocks anything vulnerable, malicious or suspiciously new — closing the gap that Composer’s own audit leaves open.

Learn more about composer-cve-gate →

homebrew-safe-upgrade

Homebrew packages aren’t pre-vetted, and a single hijacked formula can push malware to thousands of Macs. homebrew-safe-upgrade checks every package and its dependencies for known flaws before you upgrade, holds back releases that are only days old, and stops if anything can’t be verified.

Learn more about homebrew-safe-upgrade →

claude-code-cve-gate

When Claude Code installs a package for you, it does it with your access and your credentials — so its installs are your attack surface. claude-code-cve-gate quietly checks every install the assistant attempts — pip, npm, composer, cargo, go, gem, brew — against the vulnerability databases before it runs.

Learn more about claude-code-cve-gate →

mistral-code-cve-gate

The same protection for Mistral-powered coding tools, with an auditable record of every check — built for EU data-sovereign, regulated workflows where you have to prove what ran. It shares its setup with claude-code-cve-gate.

Learn more about mistral-code-cve-gate →

TrapDoor didn’t stop at packages — it also turned AI assistants into accomplices.

See AI-agent security for the other half of the defence.