install-time firewall · ai coding agents
Never installwhat nobodyread.
Your agent pulls dependencies faster than anyone can review them. DepWall reads each one at the moment of install — the name, the manifest, the lockfile, the README written at your agent. Known-good passes in milliseconds. Everything else stops and asks you.
$npm i -g depwall && depwall init
Read the install guide →
what it returns
Real verdicts, from this engine.
Not a mockup. Every row below is a verdict DepWall returns today — two confirmed against the live service this morning, one is DW-2026-0009, and three are the agent-artifact classes added in 0.5.3.
Verdict stream
replay- BLOCKnpm[email protected]known-malicious
- BLOCKnpm[email protected]known-malicious
- ASKdocreferences/setup.mddoc-injection
- BLOCKnpmexpresslopsquat
- ALLOWnpm[email protected]—
- ASKcfghooks/hooks.jsonSessionStart hook
- BLOCKnpm@ccfly/[email protected]known-malicious
- ASKcfg.claude/settings.jsonagent-autorun
- BLOCKpiprequests==9.9.9provenance
- ALLOWnpm[email protected]—
every row is a real verdict this engine returns · how they were measured
the moment it matters
This is the whole product, in six lines
A real run through the shim, recorded from a terminal. The install exits non-zero before npm resolves the tarball — so no lifecycle script, no postinstall, nothing on disk to clean up afterwards.
recorded terminal
replay of a real run · verbatim output
$ DepWall guard: npm install → BLOCKnpm:react-codeshift@latest → BLOCK [critical] hallucinated-name: "react-codeshift" is a documented LLM-hallucinated package name, registered but not established — matches the slopsquat pre-registration attack shape $ 1
the same verdict the scanner above returns for this package · try it yourself
try it · no install
Scan a package right now.
The terminal above is a recording. This one is not — it runs the same engine the CLI runs, against the live verdict service. Public package coordinates only; nothing about your machine or your code is sent.
Package scanner
idle// awaiting target — pick one above or type a name
// signals run against the live verdict service
live · same engine the CLI runs · public coordinates only
last verdict
architecture
One gate. On the path. Before anything runs.
The shim replaces the package manager on PATH. The real binary executes only if the gate exits zero — so an agent cannot route around it by picking a different command.
See every command the gate wraps
Your agent acts
npm install lodahs, or a git clone, or a lockfile it just wrote.
The shim intercepts
Shell-level, not advisory. Nothing reaches the real package manager first.
Signals run locally
Deterministic checks in milliseconds. No network needed, no code executed.
Gray zone only
Undecided cases go to the shared cache and the injection judge. Common cases never get here.
Verdict decides
The install proceeds, pauses for you, or stops before any package code runs.
ALLOW
The real binary is exec'd. You never notice.
ASK
Stops and asks. Every uncertainty lands here.
BLOCK
Never exec'd. No lifecycle script, no import.
only public package coordinates leave your machine — private repo scans run entirely locally
threat model
Six ways a dependency turns hostile
None of this is theoretical. Sonatype's 2026 report logs more than 454,600 new malicious packages in 2025 alone, and coding agents widened the surface: USENIX Security 2025 found 19.7% of 2.23M package references generated by LLMs were hallucinated. A hallucinated name someone already registered resolves like any other. Every row below has regression fixtures in the public corpus, and names the signal that fires.
Read the fixtures for each class| Class | How it works | Signal |
|---|---|---|
| Slopsquatting | An agent invents a plausible package name. An attacker registers it for real. The next time it's suggested, it resolves. | hallucinated-name slopsquat |
| Prompt injection | A README or manifest field carries instructions aimed at your agent, not at you. Treated as evidence of an attack, never as an instruction. | llm-judge |
| Lockfile poisoning | A resolved URL quietly repointed at another host, or a tarball substituted under a legitimate name. demonstrated in Snyk's 2019 lockfile research — a lockfile diff nobody reads | provenance |
| Install-time execution | Lifecycle scripts and build files that fetch and run code the moment you install — setup.py, build.rs, postinstall. both fixtures in the corpus: event-stream (2018), aimed at Copay wallets, and ua-parser-js (2021), a hijacked account shipping a miner and credential stealer | install-scripts build-scripts |
| Account takeover | A maintainer's token is stolen and a version published without the attested pipeline every previous release used. | attestation |
| Brandjacking | A days-old package with no adoption, named to look like an established one. | maturity |
verdict contract
Three verdicts. Uncertainty is one of them.
No network, a registry outage, a truncated dependency tree, an unknown package — all of them resolve to ASK, never to a silent pass. If the gate itself cannot run, the install does not proceed.
ALLOW
Nothing concerning found. The install proceeds and you never notice it happened.
ASK
Unresolved. DepWall stops and puts the decision in front of a human rather than guessing.
BLOCK
Critical evidence. The install stops before any of that package's code executes.
where it sits
The layer that runs while it's still stoppable
Three different layers, and they compose. DepWall is the one that runs at the only moment a malicious package has not executed yet.
| DepWall | Runtime agent guardsGoPlus AgentGuard, Whitzard | CI & repo scannersSnyk, Dependabot, npm audit | |
|---|---|---|---|
| Runs | At install time, before the package is on disk | While the agent acts — shell, tools, network | After commit, in the pipeline |
| Answers | Is this safe to pull? | Is this safe to do? | Is what we already have vulnerable? |
| Stops | The install, before a lifecycle script or import runs | The action the agent was about to take | The merge |
| Alone, it misses | A package that is clean on install and hostile later | Nothing — but the code is already on the machine by then | Anything an agent installed locally and never committed |
Run more than one. A runtime guard watching an agent that already installed the attacker's package is defending from inside the blast radius. DepWall is the layer that keeps it outside.
evidence
Read the generated evidence page
We publish the misses
There is no detection rate on this page
Any “99% caught” figure would be marketing. The fixtures are self-authored, so a percentage over them measures whether our tests agree with our own code — nothing more. The signals are run against an independent corpus instead: a thousand human-triaged malicious npm, PyPI and agent-skill samples from Datadog's public dataset, scored inside throwaway containers, analysis pass offline, no package ever executed.
It found three gaps, and one false positive of ours
It shipped two new PyPI detections and moved nothing on the three hundred most-downloaded npm packages. It also caught us blocking legitimate skills — a style skill's job is changing how an agent behaves, so the prompt written for packages read them as attacks. That is fixed, and the skills the fix still misses are a fixture in the corpus, asserted at the verdict we really produce.
setup
Two commands, then make it prove itself
Installing the gate is the easy part. depwall doctor is the part that matters: it runs a package that must be blocked and one that must be allowed through the real gate, and exits non-zero if either is wrong. Pick your route.
shell
$ npm install -g depwall $ depwall init # PATH shims, shell profile, Claude Code hook $ depwall doctor # proves the gate is actually blocking
powershell
$ npm install -g depwall $ depwall init # On Windows, init PRINTS the PATH line for you to add rather than # editing your PowerShell profile. Add it, open a new shell, then: $ depwall doctor
mcp config
{
"mcpServers": {
"depwall": { "command": "depwall", "args": ["mcp"] }
}
}
prompt for your agent
Install DepWall (https://depwall.com) and turn it on for this machine. It is an install-time firewall: it wraps npm/pip/cargo/go and git so a malicious or slopsquatted package is stopped before any of its code runs. Do the work, do not hand me config to edit: 1. npm install -g depwall 2. depwall init — installs the PATH shims and the agent hook 3. depwall doctor — this is the only step that matters It runs a package that MUST be blocked through the real gate, and one that must be allowed. Every line has to be ✓ or !. If any line is ✗, or the command exits non-zero, the gate is NOT protecting me — stop there and show me the output. Do not continue and do not "fix" it by disabling anything. 4. Tell me which package managers are now gated, and what ALLOW / ASK / BLOCK will each do to my installs, in one plain sentence each. Never disable DepWall, uninstall the shims, or bypass a BLOCK by calling a binary by its absolute path without asking me first.
MCP is advisory — it gives your agent something to reason about. The PATH shims are the enforcement.
boundaries
What this does not do
Stated up front, so you can judge the fit before you put it on your PATH.
- Install time, not runtime. A package clean when it installs and hostile later is outside its reach.
- No live MCP inspection. A server that only serves malicious tool descriptions once connected cannot be read in advance.
- Not a sandbox. It defends against an agent being tricked — not one already fully compromised.
- Command reading is not shell emulation. eval, variable indirection and xargs evade the command scanner; the install gate still catches the package itself.
- Malicious code in a mature package's own source. When a real maintainer ships hostile code directly — colors (2022), node-ipc's peacenotwar — there is no name mismatch, no install script and no provenance drop to catch. It is a fixture in the corpus documenting the gap, not a signal we claim.
questions
Before you put this on your PATH
All of it is answered somewhere in the docs. These are the eight worth answering before you install a thing that sits in front of every package manager you use.
Is DepWall free?
Yes. The CLI is Apache-2.0 open source and the shared verdict service is free for public-package lookups. There is a per-IP rate limit on the public endpoint — exceed it and clients degrade to a local check rather than failing.
What exactly leaves my machine?
Only public package coordinates: ecosystem, name, version. Never your code, never file contents, never private package names — a scan of a private repo runs entirely locally. The cloud only ever learns that someone asked about a public package.
How much does it slow my installs down?
Deterministic signals run locally and resolve the common case in milliseconds. Only the gray zone — a package the signals cannot decide — reaches the shared cache or the LLM judge. A cached verdict is a lookup, not an analysis.
What happens when the verdict service is down, or I'm offline?
A package already known-good in the local cache is allowed. Anything unknown becomes ASK — it stops and puts the decision in front of you. It never silently allows. If the gate itself cannot run at all, the install is blocked loudly rather than passed through.
Can my coding agent route around it?
The shim replaces the package manager on PATH, so an agent choosing a different command still hits the gate. It is not advisory and not a prompt instruction the agent can be talked out of. Calling a binary by absolute path is the known bypass — depwall doctor is what proves the gate is actually live.
What if it blocks something legitimate?
False positives are treated as defects, not noise: report the package on the corpus issue tracker and the case becomes a fixture asserted at the verdict we really produce. A published false positive of our own is written up in the evidence section above rather than quietly fixed.
Which ecosystems does it cover?
21 commands are gated at the shell level — every package manager DepWall wraps, plus git. npm is the deepest: full signal coverage and the injection judge. pip, cargo, go and the rest are gated and check the coordinates; ecosystem-specific depth lands progressively.
How do I remove it?
depwall uninstall-hook removes the shims and the agent hook, then npm uninstall -g depwall. Nothing is left behind on PATH, and no configuration outside your shell profile and DepWall's own cache directory is touched.