Modern apps are a patchwork of npm, nvm, Turborepo, ngrok, mkcert, dotenv-vault, and shadcn-cli. LPM CLI brings install, task cache, runtime, env, HTTPS, tunnels, and source delivery into one Rust binary.
Cold VitePress installs land in 2.9s vs npm at 17.4s. Warm installs in 387ms, up-to-date checks in 14ms.
Every package checked end-to-end on install — DSSE attestations, Rekor inclusion proofs, SCTs, and the full X.509 chain. Includes attestations served by npmjs, not just lpm.dev.
Lifecycle scripts blocked by default and, when they run, execute inside seatbelt (macOS), landlock + seccomp (Linux), or AppContainer (Windows).
Per-project secrets in your OS keychain, end-to-end encrypted sync across teammates, platform pushes that never route plaintext through our servers.
One command brings up your whole stack: pinned Node, fresh deps, loaded env, HTTPS, claimable public tunnels with webhook capture, multi-service ready-checks.
OIDC trusted publishers replace long-lived API tokens. Auto-OIDC token exchange in GitHub Actions and GitLab CI; provenance signed on every release.
shadcn-style: extracts package source into your repo from any registry — npm, lpm.dev, private. Files land in your repo; you own and edit them.
OSV vulns, behavioral flags (eval, child_process, network), and CSS-like selectors as CI gates across every installed package.
lpm fmt in 3ms vs npx biome at 340ms. lpm lint in 3ms vs npx oxlint at 273ms. Native runners, no per-invocation npx resolution.
One root CA trusted once. Every project gets browser-accepted HTTPS, public tunnels with webhook replay, multi-service ready-checks.
Interactive HTML graph, Mermaid output, terminal tree — built offline from your lockfile. --why <pkg> traces any path.
Filter DSL (web..., [origin/main]), workspace:* protocol, catalogs for shared versions, lpm deploy to ship one member.
Check public npm packages against firewall verdicts before tarballs are downloaded, with monitor mode for visibility and enforce mode for blocking.
Treat weaker flags, repo config, and agent-driven changes as proposals until an explicit unlock or approved machine policy says yes.
Search the installed tree with CSS-like selectors for eval, network, scripts, and vulnerabilities, then fail CI on matches.