Aikido Safe Chain vs Chainsaw

Questions and answers

As of 30 October 2026 (Safe Chain 1.5.27). Sources: the Safe Chain README and its licence file.

What is Aikido Safe Chain?

Aikido Safe Chain is a free command-line tool from Aikido Security that blocks known malware when JavaScript or Python package managers install packages. The README calls it “tokenless, free, no build data shared”. It starts a small proxy on the laptop or CI runner. Shell aliases for npm, yarn, pnpm, bun, pip, uv, poetry and other commands send downloads through that proxy, which checks every package, deep dependencies included, against Aikido Intel, Aikido’s open malware feed. By default it also hides or blocks versions younger than 48 hours. The code is AGPL-3.0, with a commercial licence on offer (licence file).

How do Safe Chain and Chainsaw’s CLI guard differ?

The main difference is the point where each tool acts. Safe Chain is a local proxy that checks each download against Aikido Intel as the package manager fetches it. Chainsaw’s guard is a wrapper for npm, pip, cargo, gem and go. Chainsaw first reads the requested packages or the resolved lockfile, then refuses before the real package manager runs. Both refuse known-malicious packages with no account. According to the Safe Chain README, Safe Chain covers the npm and PyPI ecosystems through 16 package manager commands. Chainsaw’s guard covers npm, PyPI, crates.io, RubyGems and Go modules. Chainsaw additionally checks an offline typosquat corpus, for example a misspelled copy of a popular npm name, and works with no network at all. Running chainsaw guard update adds the full public OpenSSF malicious-packages feed, still with no account. The Safe Chain README does not say what happens when the malware list cannot be fetched. Chainsaw’s CLI is Apache-2.0, and Safe Chain is AGPL-3.0.

Safe Chain’s troubleshooting guide notes that a package already in the package manager’s local cache skips the proxy. Chainsaw’s guard reads the lockfile or requirements file itself, so cached packages are still checked by name.

Where is Safe Chain stronger?

Safe Chain is stronger on JavaScript and Python tooling breadth, on its default age check, and on setup polish. Safe Chain wraps 16 commands, including yarn, pnpm, bun, rush, uv, poetry, pipx and pdm, while Chainsaw’s guard wraps only npm, pip and pip3 on those two ecosystems. Safe Chain enforces a 48-hour minimum package age on the laptop itself. It removes too-new versions from registry metadata, so resolution picks an older version instead of failing the build. Chainsaw’s 48-hour release hold runs in the registry proxy, not in the free local guard. Safe Chain exempts urgent CVE fixes from the age check once Aikido confirms the patch is clean. Each installer is pinned to a release and checked by SHA-256. The README gives copy-paste CI steps for GitHub Actions, GitLab, Jenkins, CircleCI, Azure Pipelines and Bitbucket. A team can also point Safe Chain at its own mirror of the malware list. For an npm or Python team, Safe Chain is a strong free default.

How does Safe Chain relate to Aikido’s paid products?

Safe Chain is the free entry point. The README points teams that need more ecosystems to Aikido Device Protection, which it says builds on Safe Chain and adds Maven, NuGet, Go, Ruby, Rust, IDE and browser extensions, central policy, approval workflows and MDM deployment. Aikido lists it on its pricing page, with a quote form for it on its own.

When should you choose Chainsaw instead?

Chainsaw is the better fit when installs reach beyond npm and PyPI, when a machine has no network, or when a team needs one policy across every ecosystem. On a single laptop, Chainsaw’s free guard covers Cargo, RubyGems and Go modules as well as npm and pip. It still refuses known-malicious and typosquatted names offline, from seeds embedded in the binary. For a team, package managers and CI pull through Chainsaw’s registry proxy, which covers 16 package ecosystems, including Maven, NuGet and Docker images. The proxy holds new releases for 48 hours by default. Five seeded rules refuse from the first day, for example install scripts that fetch remote URLs and packages under one day old. Every other rule starts in monitor mode and moves to enforce one at a time. Chainsaw also publishes a test of 58 supply-chain attacks from 2026 with per-attack results, so the record is checkable before adoption.

Can you run both, and how do you test them side by side?

Yes, and the cleanest way is to layer the two tools rather than stack two shell wrappers. Keep Safe Chain on laptops and CI runners, and route npm and pip through Chainsaw’s proxy with its rules in monitor mode. Safe Chain’s custom registries setting lets it check packages fetched from a private registry URL, so both tools see the same installs. For one week, Chainsaw records what each monitor-mode rule would have refused on your real dependencies, while Safe Chain keeps blocking known malware as it does today. Finally, compare the two records: Safe Chain’s file log (SAFE_CHAIN_LOG_FILE) against Chainsaw’s monitor-mode results. Count how many too-new versions each tool held back, and check whether any typosquatted name reached a lockfile. Do not run Safe Chain’s aliases and Chainsaw’s guard init shim in the same shell, because both wrap the npm command.

Sources

• Aikido Security, Safe Chain README (release 1.5.27), licence and troubleshooting guide.
• Aikido Security, Device Protection and pricing.