Private registries
Point DepWall at an internal mirror so a lockfile from it does not resolve to ASK.
If your organisation uses an internal mirror, list its hosts once:
$ export DEPWALL_REGISTRY_ALLOWLIST=npm.corp.example.com,npm.pkg.github.com
Without it, a lockfile pointing at an unrecognised host resolves to ASK — deliberate, since that is also what a poisoned lockfile looks like. Listed hosts may also serve plain HTTP for localhost mirrors, but HTTP pointed at a public registry still asks.