Deterministic signals resolve the common case in milliseconds. The gray zone goes to a judge. Nothing installs unchecked.
live · same engine the CLI runs · public coordinates only
Each row is an attack class with regression fixtures in the public corpus, and the signal that fires on it.
| Class | How it works | Signal |
|---|---|---|
| Slopsquat | An agent invents a plausible package name. An attacker registers it for real. Next time it's suggested, it resolves. | hallucinated-name slopsquat |
| Prompt injection | A README or manifest field carries instructions aimed at your agent, not you. Treated as evidence of attack, never as instruction. | llm-judge |
| Lockfile poisoning | A resolved URL quietly repointed at another host, or a tarball substituted under a legitimate name. | provenance |
| Install-time execution | Lifecycle scripts and build files that fetch and run code the moment you install — setup.py, build.rs, postinstall. | install-scripts build-scripts |
| Account takeover | A maintainer's token is stolen and a version published without the attested pipeline the previous releases used. | attestation |
| Brandjacking | A days-old package with no adoption, named to look like an established one. | maturity |
No network, a registry outage, a truncated dependency tree, or an unknown package all resolve to ASK — never a silent pass. If the gate itself cannot run, the install does not proceed.
Nothing concerning found. The install proceeds and you never notice it happened.
Unresolved. DepWall stops and puts the decision in front of a human rather than guessing.
Critical evidence. The install stops before any of that package's code executes.
Any “99% caught” figure would be marketing. The fixtures are self-authored, so a percentage over them measures whether our tests agree with our own code — nothing more. A real number needs an independent corpus that does not exist yet.
It stays in the corpus, in bold, on the evidence page. A security tool that lists only its wins is asking for trust it has not earned.
Stated up front, so you can judge the fit before installing it.