Dependency Firewall offer: 50% off the base fee. See pricing

Dependency Firewallfor npm

Your rules check every npm, Yarn, pnpm and Bun install and block risky versions before they reach node_modules.

Start 14-day free trialBook a demo
  • Built in Sweden and hosted in the EU
  • Supply chain security since 2018

Supported npm upstreams

registry.npmjs.org
JFrog Artifactory
Sonatype Nexus
GitLab
GitHub Packages
Azure Artifacts
AWS CodeArtifact

Any npm-compatible registry can be an upstream.

Rules that run before npm install

Write your own rulesLicense enforcementException workflowCentralize firewall rules

Connect one project or the whole company

Package manager config

Set the registry per project

Commit .npmrc to the project and every install goes through the firewall, on laptops and in CI.

.npmrc
registry=https://<firewall-host>/v1/<namespace-id>/npm/<firewall-id>///<firewall-host>/v1/<namespace-id>/npm/<firewall-id>/:_authToken=${BYTESAFE_TOKEN}

Best for: trying it on one project, CI pipelines, teams that own their config.

Web proxy chaining

Route the company through your web proxy

Your web proxy hands npm traffic to the firewall. Nothing changes on developer machines.

  1. Laptop, CI or agentPackage managerregistry.npmjs.org
  2. Web proxyZscaler, Prisma Access, Squid
  3. Your rulesDependency Firewall

Best for: every laptop and agent at once, including machines nobody has configured.

Web proxy chaining

What your team sees after a block

1 of 3 · Logs

Live firewall logs

Every request is logged: package name, version, status, ecosystem, which firewall evaluated it, which rule triggered and who requested it. Filter by firewall or user, and tail live during incidents or CI/CD runs.

Developers get a fast answer when an install fails, and AppSec gets an audit trail for every decision.

npm incidents and the rule that covers each

  • shai-hulud

    A self-spreading worm stole npm tokens from developers who installed an infected version, then used them to publish infected versions of those developers' own packages. Hundreds of packages were hit, and a second wave followed in November 2025.

    Release delay

  • ua-parser-js

    An attacker gained access to the maintainer's npm account and published three malicious versions. The injected payload installed a cryptominer and a credential-stealing trojan. Over 8 million weekly downloads at the time.

    Malware blocking

  • event-stream

    A maintainer transferred ownership to an unknown account. The new maintainer injected code that stole Bitcoin wallet keys from a specific Copay application. The package had 2 million weekly downloads.

    Malware blocking

  • colors.js / faker.js

    The maintainer published versions that caused applications to print infinite ANSI sequences and nonsense strings to stdout. Thousands of applications broke on upgrade without any warning.

    Release delay

Clients, proxies and deployment

  • Clients

    npm, Yarn Classic and Berry, pnpm and Bun.

  • Web proxies

    Zscaler, Prisma Access, Squid and other web proxies that decrypt TLS.

  • Deployment

    Cloud as EU-hosted SaaS. Enterprise as Managed Cloud, BYO Cloud or On-Premise.

Explore supported ecosystems

See the setup, rules and incidents for each package ecosystem.

Questions

How do I configure npm to use Bytesafe Dependency Firewall?
Run `npm config set registry https://<firewall-host>/v1/<namespace-id>/npm/<firewall-id>/` with the namespace ID and firewall ID from the firewall's Setup tab. Yarn, pnpm and Bun support the same approach via their respective config files. See docs.bytesafe.dev for step-by-step instructions.
Does it work with private npm packages?
Yes. Bytesafe Dependency Firewall can proxy multiple upstreams. Configure it to serve your private registry for scoped packages and npm for public ones. Private packages always resolve first, which also prevents dependency confusion attacks.
Will it break my existing package-lock.json or yarn.lock?
No. Bytesafe Dependency Firewall is a transparent proxy. It serves the same package metadata and tarballs as npm. Your lock files remain valid and installs continue to be reproducible.
Does the zero-day safety delay apply to all npm packages?
You configure which rules apply. You can delay all new versions, or only versions from packages that have never been seen in your organization before. Rules can target specific package name patterns or version ranges.
Can different npm projects have different policies?
Yes. You can create separate firewalls per project. They are lightweight and easy to clone. You can also differentiate by the user or token used for the session. Firewall configurations are small JSON files that can be managed in Git.
Can npm installs go through the firewall without changing developer machines?
Yes, with web proxy chaining. A company web proxy that already decrypts TLS, such as Zscaler, Prisma Access or Squid, hands registry traffic to the firewall. Package managers keep the public registry address, and rules, exceptions and logs apply as with a configured client. It is set up on request. Web proxy chaining
What happens if a npm package passes through but malware is found later?
The firewall tracks all packages via observations: first-seen date, last-seen date, and which firewalls they passed through. When new malware data surfaces, you can see exactly which projects downloaded the affected package and when.
Can firewall rules be automated?
Yes. All configuration is available via API. Configurations can be version-controlled in Git and deployed through your own automation. All changes are tracked with full rollback support.
Does Dependency Firewall work with enterprise repository platforms?
Yes. Dependency Firewall speaks the same protocols as your package managers, so it is transparent to enterprise repository platforms and package registries, including JFrog Artifactory, Sonatype Nexus, GitLab, GitHub Packages and Azure Artifacts. It can also sit directly in front of the public registry.
How is licensing structured?
Cloud is the SaaS plan. Enterprise is for custom deployment, Managed Cloud or On-Premise. Cloud is priced on whichever you use most: active users, packages scanned or downloads served. Plan details and add-ons

Also in the Bytesafe platform

Put npm installs behind the firewall

Point one pipeline at Dependency Firewall and read the decisions in the log. The trial runs for 14 days.

Start 14-day free trialBook a demo