Package FirewallOne package policy for every developer laptop.
Developer machines hold the keys to production, and every one of them runs npm install and pip install many times a day. Package Firewall for teams puts the same checks on all of them and lets you manage them from one place.
Team features are being built now. Design partners help shape them and get early access.
- Deploy silently with Jamf, Intune, Kandji or any MDM
- Set the age rule, allow lists and deny lists for the whole org
- Add private registries such as Artifactory, Nexus and GitHub Packages
- Decide whether developers can make their own exceptions
- Sign in with an email link or SSO
- See blocked installs and unprotected devices across the fleet
- Send events to your SIEM
How it fits together
Every device keeps enforcing on its own. The org layer only tells it what policy to follow and collects what happened.
Signed org config
Devices pull a policy bundle signed with your org's key, the same way they verify the malware list. If the server is down, they keep the last good bundle.
Host it anywhere
Use Package Firewall Cloud, or publish the signed bundle from your own server or bucket and run with no cloud dependency at all.
Visible to developers
The app shows which settings your org manages, and developers can request an exception that goes to your security team for review.
Personal and team
| Personal (available now) | Teams (in development) | |
|---|---|---|
| Malware list and 48-hour rule | Yes | Yes, with an org-set age |
| npm and PyPI public registries | Yes | Yes |
| Private registries | No | Yes |
| Allow list | Local, per device | Org-wide, plus reviewed requests |
| Deployment | Installer | MDM, no user prompts |
| Activity | On the device | Fleet view and SIEM export |
| Sign-in | None needed | Email link or SSO |
Help us build it.
We're looking for security teams who want to protect developer machines from malicious packages. Tell us about your fleet and the tools your developers use.