Package FirewallMalicious packages never reach your machine.
Package Firewall runs on your computer and checks every npm and PyPI download before it lands. Known malware and versions that are less than 48 hours old are stopped at the network, whatever tool asked for them.
Works with npm, npx, pnpm, Yarn, Bun, pip, uv and Poetry. No per-project setup.
Supply chain attacks start with one install.
Attackers publish look-alike packages or hijack a maintainer account and push a poisoned release. Install scripts run with your permissions, next to your SSH keys, cloud credentials and source code. Most of these releases are reported and pulled within days, but the people who installed them in the first hours are already compromised.
Known malware, blocked
A signed malware list built from OSV malicious-package reports covers npm and PyPI and refreshes automatically. Listed versions can't be downloaded.
A 48-hour cooling-off period
Brand-new versions wait 48 hours, long enough for the community and scanners to catch most attacks. Your package manager quietly picks the newest version that is old enough.
Every tool, no setup
It works at the network level on your machine, so it covers terminals, editors, scripts and AI coding agents alike. Nothing to add to each project.
How it works
Package Firewall is a small local proxy with a native network extension. It only looks at traffic to public package registries; everything else on your machine is left alone.
Intercept
Requests to registry.npmjs.org, pypi.org and the other public npm and PyPI hosts are routed to the local proxy.
Check
Each package version is checked against the signed malware list and its verified publish time.
Filter
Blocked versions are removed from package metadata, so resolvers fall back to a safe version instead of failing.
Enforce
A direct download of a blocked version is refused. If a check can't be completed, the download is refused too.
Covers the tools you already use
One install protects every package manager on the machine.
npm registry
registry.npmjs.org, registry.yarnpkg.com and registry.npmmirror.com
Python Package Index
pypi.org and files.pythonhosted.org
Built to stay out of your way
Installs keep working
Blocked versions are hidden rather than broken, so npm install resolves to the previous safe release and your lockfile stays sane.
Local allow list
Need a release from this morning? Allow that exact version on your machine, confirmed with Touch ID on a Mac.
Activity you can read
See what was blocked, when, and why. History stays on your computer and is pruned on the schedule you choose.
Finds what's already there
A daily scan of package caches and project folders flags listed packages that were installed before protection started.
Signed and verified
The malware list is signed with Ed25519 and checked before use, and it can't be rolled back to an older copy.
Private by design
Checks run on your computer. The app downloads the signed list; it uploads no telemetry and no record of what you install.
Platforms
Package Firewall is in early access. Every build today is a test build, and we ship often.
macOS Early access
Signed and notarized installer with a native network extension and a menu bar app.
Windows In progress
A Windows service and installer are being built on the same enforcement engine.
Linux Planned
Planned for developer workstations and CI runners.
For security teams
Roll Package Firewall out to every developer laptop, set policy once and see what was blocked across the fleet.
- Silent deployment through MDM
- Central policy: age rule, org allow and deny lists, private registries
- Sign in with email or SSO
- Fleet activity and SIEM export
Questions
What does Package Firewall block?
Package versions on its signed malware list, which is built from OSV malicious-package reports, and versions published less than 48 hours ago. If a version's publish time can't be verified, it is blocked as well. You can allow a specific version locally when you need it.
Do I have to change my npm or pip configuration?
No. Package Firewall intercepts traffic to the public npm and PyPI registries on the machine, so npm, npx, pnpm, Yarn, Bun, pip, uv and Poetry are covered without per-project setup. It adds its own certificate authority, scoped to those registry hosts, and points Node's package managers at it.
Will it break my installs?
Usually not. Blocked versions are removed from the registry metadata your package manager sees, so it picks the newest allowed version. If a lockfile pins a blocked version, the download is refused and you'll see a 403 until you update the lock or allow that version.
Does it upload my activity?
No. Checks run on your computer and the activity history stays there. The app downloads the signed malware list; it does not upload telemetry.
What isn't covered?
Packages restored from a local cache skip the download check (the cache scan covers them instead). Private registries, mirrors other than the ones listed, direct tarball URLs, Git dependencies and other ecosystems are not covered yet.