install-time firewall · ai coding agents

Every package your agent pulls, inspected before it lands.

Deterministic signals resolve the common case in milliseconds. The gray zone goes to a judge. Nothing installs unchecked.

$npm install -g depwall

node ≥20 · darwin · linux · win32 · apache-2.0

Package scanner idle
// awaiting target — pick one above or type a name // signals run against the live verdict service

live · same engine the CLI runs · public coordinates only

21managers gated
16attack classes
72public fixtures
0rates claimed
threat model

What actually arrives with a dependency

Each row is an attack class with regression fixtures in the public corpus, and the signal that fires on it.

ClassHow it worksSignal
Slopsquat An agent invents a plausible package name. An attacker registers it for real. Next time it's suggested, it resolves. hallucinated-name
slopsquat
Prompt injection A README or manifest field carries instructions aimed at your agent, not you. Treated as evidence of attack, never as instruction. llm-judge
Lockfile poisoning A resolved URL quietly repointed at another host, or a tarball substituted under a legitimate name. provenance
Install-time execution Lifecycle scripts and build files that fetch and run code the moment you install — setup.py, build.rs, postinstall. install-scripts
build-scripts
Account takeover A maintainer's token is stolen and a version published without the attested pipeline the previous releases used. attestation
Brandjacking A days-old package with no adoption, named to look like an established one. maturity
verdict contract

Three outcomes. Uncertainty is one of them.

No network, a registry outage, a truncated dependency tree, or an unknown package all resolve to ASK — never a silent pass. If the gate itself cannot run, the install does not proceed.

ALLOW

Nothing concerning found. The install proceeds and you never notice it happened.

ASK

Unresolved. DepWall stops and puts the decision in front of a human rather than guessing.

BLOCK

Critical evidence. The install stops before any of that package's code executes.

evidence

The corpus is public, including the misses

No detection rate is published

Any “99% caught” figure would be marketing. The fixtures are self-authored, so a percentage over them measures whether our tests agree with our own code — nothing more. A real number needs an independent corpus that does not exist yet.

One fixture is a documented failure

It stays in the corpus, in bold, on the evidence page. A security tool that lists only its wins is asking for trust it has not earned.

Read the generated evidence page →

boundaries

What DepWall does not do

Stated up front, so you can judge the fit before installing it.