Computer Police
block malicious NPM/pip installs locally
Last verified:
What is Computer Police?
Computer Police is a local registry proxy that acts as a supply-chain firewall, blocking confirmed-malicious npm and pip package installs before they touch your disk. It was built by Vidoc Security to protect developers, CI/CD pipelines, and AI coding agents from running malware that ships on legitimate package registries like npm and PyPI.
The tool works by intercepting every npm install, pip install, or uv add command and checking it against the public OSV malware feed. If a package version is listed as malicious in an OSV advisory, Computer Police returns a 403 Forbidden error. Allowed packages pass through unchanged. This blocks malware at install time, before lifecycle scripts can execute.
Computer Police is designed for three main audiences: developers using AI coding agents (Claude Code, Codex, Cursor, OpenCode) that install packages automatically; CI/CD operators who want supply-chain protection without changing their build process; and teams running agent sandboxes like devcontainers or GitHub Actions runners. It supports JavaScript/TypeScript/Node (npm, yarn, pnpm, bun) and Python/PyPI (pip, uv, poetry, pdm, pipx) with more ecosystems planned.
The tool is open source under the MIT license, runs on macOS, Linux, and Windows, requires no root access or kernel extensions, and is privacy-focused with no telemetry or analytics. Everything runs locally on your machine, with the only outbound call being to fetch the public OSV malicious-package advisory snapshot.
Computer Police pricing
Pricing model: Freemium
Free and open source under MIT license. No paid tiers or plans. The tool is completely free to use with all features included.
Computer Police pros
- Blocks confirmed-malicious npm and pip installs before they touch disk
- Uses public OSV malware feed for accurate threat detection
- Zero false alarms - only blocks packages with OSV malware advisories
- No root access required
- No kernel extension needed
- No system proxy configuration required
- Works with AI coding agents without any agent changes
- Simple one-line curl install command
- Fully reversible installation with computer-police uninstall
- Local-first privacy - no telemetry or analytics
- No package names or lockfiles leave your machine
- Open source under MIT license
- Supports npm, yarn, pnpm, bun for JavaScript/TypeScript
- Supports pip, uv, poetry, pdm, pipx for Python
- Cross-platform: macOS, Linux, and Windows support
- Low noise design focused on one job only
- Blocks malware at install time before lifecycle scripts execute
- Can be baked into container images for team-wide protection
Computer Police cons
- Only blocks confirmed malware, not unverified suspicious packages
- Not a vulnerability scanner for CVEs
- Not a license scanner
- Not a static analyzer
- No heuristic-based
- detection
- Limited to npm and pip ecosystems currently
- Conda, Ruby, PHP, Rust, Go, JVM, .NET support still planned
- Only catches packages already in OSV advisory database
Frequently asked questions about Computer Police
What is Computer Police?
Computer Police is a local registry proxy that acts as a supply-chain firewall, blocking confirmed-malicious npm and pip installs before they touch your disk. It-inspects install requests, matches them against the OSV malware feed, and either blocks, passes through, or logs the request.
How do I install Computer Police?
Install with one curl command: curl -fsSL https://computer.police.dev/install | bash, then run computer-police install. No root, no kernel extension, no system proxy required. You can uninstall with computer-police uninstall.
What package managers does Computer Police support?
Currently supports JavaScript/TypeScript/Node package managers (npm, yarn, pnpm, bun) and Python/PyPI package managers (pip, uv, poetry, pdm, pipx). Support for Conda, Ruby, PHP, Rust, Go, JVM, and .NET is planned.
Does Computer Police send my package data to external servers?
No. Everything runs locally on your machine. The only outbound network call is fetching the public OSV malicious-package advisory snapshot. There is no telemetry, no analytics, and no package names, lockfiles, or install history leaving your machine.
Will Computer Police slow down my package installs?
No. The tool is designed for low noise and to not slow you down. Allowed installs pass through unchanged, and the check against the OSV feed is fast. It does not cry wolf with false alarms.
What happens when Computer Police blocks a package?
Confirmed malware gets a 403 Forbidden error. You will see npm error code E403 with a message like '403 blocked by computer-police: OSV MAL-2026-XXXX' indicating the OSV advisory that triggered the block.
Who is Computer Police built for?
Built for three jobs: developers using AI coding agents (Claude Code, Codex, Cursor, OpenCode) who want a safety net for automatic package installs; CI/CD operators who want supply-chain protection without changing their build; and teams running agent sandboxes like devcontainers or GitHub Actions runners.
Is Computer Police open source?
Yes, Computer Police is open source under the MIT license. The GitHub repository is available, and the code can be reviewed for security and transparency.
What operating systems does Computer Police run on?
Computer Police runs on macOS, Linux, and Windows. It is written in Go with zero external dependencies.
Why does Computer Police exist?
It exists because AI agents install packages you never reviewed (calling npm install and pip install dozens times daily), real malware ships on real registries weekly via typosquats/hijacked maintainers/dependency-confusion, and existing tools like audits and CVE dashboards run too late after the package is already on disk and possibly executed.