diff --git a/README.md b/README.md index 45317a0..872e409 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ The Aikido Safe Chain **prevents developers from installing malware** on their w The Aikido Safe Chain wraps around the [npm cli](https://github.com/npm/cli), [npx](https://github.com/npm/cli/blob/latest/docs/content/commands/npx.md), [yarn](https://yarnpkg.com/), [pnpm](https://pnpm.io/), and [pnpx](https://pnpm.io/cli/dlx) to provide extra checks before installing new packages. This tool will detect when a package contains malware and prompt you to exit, preventing npm, npx, yarn, pnpm or pnpx from downloading or running the malware. -![demo](https://aikido-production-staticfiles-public.s3.eu-west-1.amazonaws.com/safe-pkg.gif) +![demo](./docs/safe-package-manager-demo.png) Aikido Safe Chain works on Node.js version 18 and above and supports the following package managers: @@ -57,6 +57,50 @@ The Aikido Safe Chain integrates with your shell to provide a seamless experienc More information about the shell integration can be found in the [shell integration documentation](docs/shell-integration.md). +## Usage in CI/CD + +[Learn more about Safe Chain CI/CD integration in the Aikido docs.](https://help.aikido.dev/code-scanning/aikido-malware-scanning/malware-scanning-with-safe-chain-in-ci-cd-environments) + +## Usage in Docker + +To use the Aikido Safe Chain in a Docker container, you can follow these steps: + +1. **Install the Aikido Safe Chain package** in your Dockerfile: + + ```dockerfile + RUN npm install -g @aikidosec/safe-chain + ``` + +2. **Setup the shell integration** by running: + + ```dockerfile + RUN safe-chain setup-ci + ``` + +3. **Add the shims directory to your PATH** to ensure the aliases are available in your Docker container: + + ```dockerfile + ENV PATH="~/.safe-chain/shims:${PATH}" + ``` + +4. **Verify the installation** by running: + ```dockerfile + RUN npm install safe-chain-test + ``` + +Example Dockerfile: + +```dockerfile +FROM node:24 +RUN npm install -g @aikidosec/safe-chain +RUN safe-chain setup-ci +ENV PATH="~/.safe-chain/shims:${PATH}" +WORKDIR /app + +RUN npm init -y +RUN npm install safe-chain-test +``` + ## Uninstallation To uninstall the Aikido Safe Chain, you can run the following command: @@ -85,7 +129,3 @@ Example usage: ```shell npm install suspicious-package --safe-chain-malware-action=prompt ``` - -# Usage in CI/CD - -[Learn more about Safe Chain CI/CD integration in the Aikido docs.](https://help.aikido.dev/code-scanning/aikido-malware-scanning/malware-scanning-with-safe-chain-in-ci-cd-environments) diff --git a/docs/safe-package-manager-demo.png b/docs/safe-package-manager-demo.png new file mode 100644 index 0000000..b8997cc Binary files /dev/null and b/docs/safe-package-manager-demo.png differ