Git's Trust Model is Broken
Why Git's identity model is insecure, how easy commit spoofing is and how to fix it with commit signing. Explains the risks, demonstrates real-world spoofing and provides a step-by-step solution for securing your commits.
https://t128n.github.io/packy/
If you’ve ever debugged inside a secure network, on a factory floor, or in a classroom PC without internet, you know the pattern. You need one more package, but you can’t run npm install
. Copying files around by hand is brittle and slow. Standing up a local registry is overkill and often blocked by policy.
I wanted a tool I could open in any modern browser, type a package and version, and end up with a single archive that “just works” offline later.
Packy resolves, fetches, and packages your target npm module and all of its transitive dependencies into one tarball you can move by USB, shared drive or sneakernet. Everything happens locally in the browser via WebContainers. No API keys, no telemetry, no server.
Concretely, Packy orchestrates the same steps you’d do by hand, but automated and sandboxed:
It runs npm i
to resolve and materialize the full dependency tree in an isolated filesystem.
It rewrites the package.json
of the selected package to include it’s dependencies in bundle.
It runs npm pack
to generate a single tarball that contains the package and its dependencies, ready for offline delivery.
Zero setup and zero trust surface. A browser app:
It reduces friction. You get in, get a clean archive and get moving.
Packy shines when you need to move fast without internet or infrastructure. It’s ideal for shipping Node.js apps into locked-down or air-gapped environments where online installs aren’t an option. It’s equally at home in teaching contexts (workshops, classrooms and trainings) where connectivity can be flaky or restricted and you need a predictable setup. It also doubles as a dependable way to archive dependencies for reproducible builds or long-term snapshots. And when you’re heading into the field, Packy helps you prepare “dev kits” that contain everything required to get unstuck.
npm i
runs inside that sandbox, producing a real, resolved node_modules
tree.package.json
is rewritten to include all dependencies when being packaged.npm pack
emits a standard tarball you can store, move, and install from later.This approach mirrors npm’s semantics closely while remaining transparent and auditable.
Packy is open-source and evolving. Use it here:
https://t128n.github.io/packy/
If you’re curious how it works or want to contribute, dive into the codebase, file issues or suggest improvements.