primer docs

Pre-install security interceptor for package managers

primer sits in front of npm, pip, go get, and cargo add. Before any package reaches your system it is checked against the OSV vulnerability database. Clean installs pass through silently. Vulnerable ones are blocked with a prompt and a fix command.

Get started

New to primer? Three paths — pick the one that fits:

GitHub App — install the primer GitHub App on a repository. Every push and pull request is scanned automatically, a Check Run appears in the PR, and findings are posted as a comment. No workflow file, no CLI install, no configuration.
Local install — run primer on your machine; npm install, pip install, and cargo add are intercepted automatically after primer init.
GitHub Actions — add one workflow file and protect a repository in CI without installing anything locally.

Supported ecosystems

Ecosystem	Intercepted commands	Manifest / Lockfile
Python	`pip`, `uv`, `poetry`	`requirements.txt`, `pyproject.toml`, `uv.lock`, `poetry.lock`
Node.js	`npm`, `yarn`, `pnpm`	`package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`
Go	`go get`, `go mod`	`go.mod`, `go.sum`
Rust	`cargo add`	`Cargo.toml`, `Cargo.lock`

How it works

Intercept — the shim captures the package name before the real binary runs.
Scan — primer queries OSV and checks the 24 h local cache.
Decide — clean results pass through silently; findings prompt the user with a CVE summary and a ready-to-run fix command.
Execute or block — continue with y, abort with N (exit code 1).

Use the navigation on the left to explore all topics, or visit the primer homepage for a full overview.