Block malicious packages
Keep packages that are known to be malicious out of every build and off every laptop. A malware rule checks each package as it is downloaded or published, and blocks the ones with a malware finding.
How malware blocking works
1Turn it on for installs and publishes
Add a malware rule for downloads, and the same rule for uploads if you publish through the firewall. What you ship is then held to the standard of what you install.
2Decide how sure it has to be
Start at known malware, which blocks confirmed findings only. Lower the bar to suspicious packages when you want to, and run that as log-only first to see what it would stop.
3A block comes with its reason
A blocked version fails the install, and the log names the package, the rule and who asked for it. If a block looks wrong, ask your security team for an exception.
What malware blocking covers
- Reported malware and suspicious content
- A version reported as malicious is blocked. So is one whose own content shows a finding, at the confidence you chose.
- Laptops, pipelines and publishes
- The rule runs on every download and every upload through the firewall, whoever or whatever made the request.
- A wrong block has a way out
- An exception lets the packages and versions it names through one rule. It carries a reason and can expire, and every other rule still applies.
- Know who already has it
- When a version is flagged after you served it, observations show which firewalls served it and when.
{ "id": "block-malware-download", "executionPhase": "download", "selector": { "function": { "name": "malware", "options": { "minimumConfidence": "known_malware", "effort": "known" } } }, "ruleEffect": { "block": true, "log": true }}Questions
Do developers need to install anything?
No. Only the registry URL changes. There is no agent on developer machines.
Does a malware rule slow down installs?
With the default effort the rule decides on findings that already exist, so there is nothing to wait for. Waiting for a full analysis is a separate setting, best used on publishes.
Does it replace a release delay?
No. A delay holds every new version while findings catch up, and the malware rule blocks what is already known. Run both.
What if a block is wrong?
Keep the rule on. Ask your security team for an exception for that exact package and version, with a reason and a short expiry date. The block comes back by itself when the exception expires.
More features
- Hold new releases until they have agedRelease delay
- Set the rules centrally for every team and agentCentralize firewall rules
- Block versions with known vulnerabilitiesVulnerability blocking
- Resolve internal names from your own registryDependency confusion
- Block packages by licenseLicense enforcement
- Run image pulls through the same rulesContainer firewalling
Try it on one registry
Point one package manager at Dependency Firewall and check the log after the next install. The trial runs 14 days.