tinyNpm is a Visual Studio Code extension aimed at helping developers mitigate npm supply chain attacks and improve package management. According to its announcement, the extension works by buffering npm updates: instead of showing the newest available package versions, it recommends or applies a “latest” version that is a specified number of days old. The goal is to reduce exposure to recently published packages that could be part of an attack.
The extension also adjusts dependency version specifiers in package.json by removing the caret (^) when present, giving developers tighter control over which versions their applications can use. In addition, tinyNpm provides on-hover guidance in the editor to help developers monitor installed dependencies. The hover information includes warnings related to package staleness, higher dependency counts, and download metrics.
The creators state that these features can be implemented using data available through the npm API and make the extension available through the Visual Studio Code marketplace.
