# Package Firewall: full site text

Source: https://packagefirewall.com/
Last updated: 2026-10-20

## What Package Firewall is

Package Firewall runs on your computer and checks every npm and PyPI download before it lands. Known malware and versions that are less than 48 hours old are stopped at the network, whatever tool asked for them. It works with npm, npx, pnpm, Yarn, Bun, pip, uv and Poetry, with no per-project setup.

Status: early access for macOS. Every build today is a test build. Windows is in progress. Linux is planned.

## Why it exists

Software supply chain attacks start with one install. Attackers publish look-alike packages (typosquats) or hijack a maintainer account and push a poisoned release. Install scripts run with the developer's permissions, next to SSH keys, cloud credentials and source code. Most of these releases are reported and pulled within days, but the people who installed them in the first hours are already compromised.

Package Firewall addresses this with two rules:

1. Known malware is blocked. A signed malware list built from OSV (https://osv.dev/) malicious-package (MAL) reports covers npm and PyPI and refreshes automatically. Listed versions can't be downloaded.
2. A 48-hour cooling-off period. Versions published less than 48 hours ago are held back, long enough for the community and scanners to catch most attacks. The package manager picks the newest version that is old enough.

Because it works at the network level on the machine, it covers terminals, editors, scripts and AI coding agents alike.

## How it works

1. Interception. On macOS a network extension routes connections for the public registry hosts to a local proxy, pf-proxyd. Only these hosts are intercepted: registry.npmjs.org, registry.yarnpkg.com, registry.npmmirror.com (npm) and pypi.org, files.pythonhosted.org (PyPI). The proxy terminates TLS with a certificate authority created on the machine and name-constrained to those hosts. Its private key is held by a separate system service and is not exportable.

2. Checks. For every package version the proxy checks whether it is on the malware list and whether it is at least 48 hours old. The list is signed with Ed25519, verified before use and can't be rolled back to an older copy. The publish time comes from the registry's own metadata; if it can't be verified, the version is treated as too new.

3. Filtering metadata. When npm, pnpm, Yarn or Bun fetch a package's metadata, blocked versions are removed before the response reaches them, and dist-tags such as "latest" are repaired so they never point at a blocked version. PyPI metadata (the Simple index and JSON API) is filtered the same way for pip, uv and Poetry. The package manager resolves to a safe version on its own, with no errors.

4. Enforcing downloads. Tarballs and wheels are checked again at download time, so a lockfile or a direct URL can't skip the rules. A blocked download gets 403 Forbidden. If the proxy can't reach a decision, for example because the malware list is missing, the download is refused rather than let through.

5. Exceptions. The local allow list lets a user allow one exact version on their machine, after confirming with Touch ID. Every allow is recorded in the activity history.

6. What's already installed. A daily scan of package manager caches and project folders flags packages on the malware list that were installed before protection started or restored from a cache without a download.

## Features

- Installs keep working: blocked versions are hidden rather than broken, so npm install resolves to the previous safe release.
- Local allow list with Touch ID confirmation on macOS.
- Activity history: what was blocked, when and why. Stored on the device, pruned on a schedule the user chooses.
- Daily cache and project scan.
- Signed malware list (Ed25519) with rollback protection.
- Private by design: checks run locally; no telemetry or install history is uploaded. The app downloads the signed malware list.

## Not covered yet

- Packages restored from a local cache skip the download check (the daily scan covers them).
- Private registries, mirrors other than the hosts listed above, direct tarball URLs and Git dependencies.
- Ecosystems other than npm and PyPI.

## Platforms

- macOS: early access. Signed and notarized installer with a native network extension and a menu bar app.
- Windows: in progress, a Windows service and installer on the same enforcement engine.
- Linux: planned, for developer workstations and CI runners.

## Package Firewall for teams (in development)

One package policy for every developer laptop. Planned features:

- Silent deployment with Jamf, Intune, Kandji or any MDM.
- Org-wide age rule, allow lists and deny lists.
- Private registries such as Artifactory, Nexus and GitHub Packages.
- Control over whether developers can make their own exceptions, plus exception requests reviewed by the security team.
- Sign-in with an email link or SSO.
- Fleet view of blocked installs and unprotected devices.
- SIEM export.

Design: devices pull a policy bundle signed with the org's key, the same way they verify the malware list, and keep the last good bundle if the server is down. The bundle can come from Package Firewall Cloud or from the org's own server or bucket, so teams can run with no cloud dependency. Each device keeps enforcing on its own.

Security teams interested in the design partner program can write to hello@packagefirewall.com.

## FAQ

Q: What does Package Firewall block?
A: Package versions on its signed malware list, built from OSV malicious-package reports, and versions published less than 48 hours ago. If a version's publish time can't be verified, it is blocked as well. A specific version can be allowed locally.

Q: Do I have to change my npm or pip configuration?
A: No. Package Firewall intercepts traffic to the public npm and PyPI registries on the machine, so npm, npx, pnpm, Yarn, Bun, pip, uv and Poetry are covered without per-project setup. It adds its own certificate authority, scoped to those registry hosts, and points Node's package managers at it.

Q: Will it break my installs?
A: Usually not. Blocked versions are removed from the registry metadata the package manager sees, so it picks the newest allowed version. If a lockfile pins a blocked version, the download is refused with a 403 until the lock is updated or that version is allowed.

Q: Does it upload my activity?
A: No. Checks run on the computer and the activity history stays there. The app downloads the signed malware list; it does not upload telemetry.

Q: What isn't covered?
A: Packages restored from a local cache skip the download check (the cache scan covers them instead). Private registries, other mirrors, direct tarball URLs, Git dependencies and other ecosystems are not covered yet.

## Contact

hello@packagefirewall.com