apm documentation
apm is a package registry in front of npm. It scores every version, can pull a bad version at any time, and waits for a person to approve each publish.
apm is an open-source registry that stock bun, npm and pnpm talk to unchanged, plus apm, a small CLI that checks a package before your package manager installs, runs or publishes it. It proxies the public npm registry, so every package you already use has an apm score.
- Install through apm in two minutes: Quick start.
- Publish your first package: Publish a package.
- Find out what the score can and cannot see: How the score works.
What apm changes
| On npm today | With apm |
|---|---|
| A hacked version stays installable unless it is under 72 hours old and nothing depends on it. | yank hides a version from new installs. revoke returns 410 for its tarball and a critical advisory in bun audit and npm audit, at any time. |
| A stolen account means rotating tokens and hunting versions by hand. | apm incident --since <time> revokes every token and every version published since then. |
| No safety signal. | Every version gets a score from 0 to 100. Every point lost cites a file and line. Popularity is never an input. |
| A leaked token can publish. | A version uploaded with a login token waits until a person approves it with a passkey or an authenticator code. |
| New versions install the minute they appear. | apm add and the ~safe view skip versions under 24 hours old and versions scoring under 40. |
| Unscoped names are first come, first served. | New packages are scoped to your GitHub login. Names one edit from a popular package are refused. |
The parts
| Part | What it does | Where |
|---|---|---|
| Registry | npm-compatible registry, upstream proxy for npm, scores, yank and revoke, staged publishing. | https://registry.apmjs.dev/ |
~safe view |
The same registry with young and low-scoring versions hidden. Works with any client. | https://registry.apmjs.dev/~safe/ |
| Website | Package search, version pages with evidence, publish approvals, your account. | https://apmjs.dev |
apm CLI |
Checks before it hands the work to bun, npm, pnpm or yarn. | CLI reference |
| Bun scanner | Makes plain bun install refuse revoked and low-scoring versions. |
Bun scanner |
| AI release review | A language model reads each new release and reports cited findings next to the score. | AI review |