install-time firewall · ai coding agents
Nothing installs unchecked.
DepWall inspects every package your agent pulls — before it lands. Deterministic signals resolve the common case in milliseconds; the gray zone goes to a judge.
$npm install -g depwall
Package scanner
idle
// awaiting target — pick one above or type a name
// signals run against the live verdict service
live · same engine the CLI runs · public coordinates only
21managers gated
16attack classes
72public fixtures
0rates claimed
architecture
One gate, on the path, before anything runs
The shim replaces the package manager on PATH. The real binary only executes if the gate exits zero — so an agent cannot route around it by choosing a different command.
01
Your agent acts
npm install lodahs, or a git clone, or a lockfile it just wrote.
02
The shim intercepts
Shell-level, not advisory. Nothing reaches the real package manager first.
03
Signals run locally
Deterministic checks in milliseconds. No network needed, no code executed.
04
Gray zone only
Undecided cases go to the shared cache and the injection judge. Common cases never get here.
05
Verdict decides
The install proceeds, pauses for you, or stops before any package code runs.
ALLOW
The real binary is exec'd. You never notice.
ASK
Stops and asks. Every uncertainty lands here.
BLOCK
Never exec'd. No lifecycle script, no import.
only public package coordinates leave your machine — private repo scans run entirely locally
threat model
What actually arrives with a dependency
Each row is an attack class with regression fixtures in the public corpus, and the signal that fires on it.
| Class | How it works | Signal |
|---|---|---|
| Slopsquat | An agent invents a plausible package name. An attacker registers it for real. Next time it's suggested, it resolves. | hallucinated-name slopsquat |
| Prompt injection | A README or manifest field carries instructions aimed at your agent, not you. Treated as evidence of attack, never as instruction. | llm-judge |
| Lockfile poisoning | A resolved URL quietly repointed at another host, or a tarball substituted under a legitimate name. | provenance |
| Install-time execution | Lifecycle scripts and build files that fetch and run code the moment you install — setup.py, build.rs, postinstall. | install-scripts build-scripts |
| Account takeover | A maintainer's token is stolen and a version published without the attested pipeline the previous releases used. | attestation |
| Brandjacking | A days-old package with no adoption, named to look like an established one. | maturity |
verdict contract
Three outcomes. Uncertainty is one of them.
No network, a registry outage, a truncated dependency tree, or an unknown package all resolve to ASK — never a silent pass. If the gate itself cannot run, the install does not proceed.
ALLOW
Nothing concerning found. The install proceeds and you never notice it happened.
ASK
Unresolved. DepWall stops and puts the decision in front of a human rather than guessing.
BLOCK
Critical evidence. The install stops before any of that package's code executes.
where it sits
Not a runtime guard, and not a CI scanner
These are three different layers, and they compose. DepWall is the one that runs while the install is still stoppable — which is also the only moment a malicious package has not executed yet.
| DepWall | Runtime agent guards | CI & repo scanners | |
|---|---|---|---|
| Runs | At install time, before the package is on disk | While the agent acts — shell, tools, network | After commit, in the pipeline |
| Answers | Is this safe to pull? | Is this safe to do? | Is what we already have vulnerable? |
| Stops | The install, before a lifecycle script or import runs | The action the agent was about to take | The merge |
| Alone, it misses | A package that is clean on install and hostile later | Nothing — but the code is already on the machine by then | Anything an agent installed locally and never committed |
Run more than one. A runtime guard watching an agent that already installed the attacker's package is defending from inside the blast radius; DepWall is the layer that keeps it outside.
evidence
The corpus is public, including the misses
No detection rate is published
Any “99% caught” figure would be marketing. The fixtures are self-authored, so a percentage over them measures whether our tests agree with our own code — nothing more. A real number needs an independent corpus that does not exist yet.
One fixture is a documented failure
It stays in the corpus, in bold, on the evidence page. A security tool that lists only its wins is asking for trust it has not earned.
setup
Let the agent install its own gate
Installing a shim, wiring a hook and checking it actually fired is exactly the errand a coding agent is good at. Paste this into Claude Code, Cursor or Codex and let it do the work — then make it prove the gate is live before you trust it.
prompt for your agent
Install DepWall (https://depwall.com) and turn it on for this machine. It is an install-time firewall: it wraps npm/pip/cargo/go and git so a malicious or slopsquatted package is stopped before any of its code runs. Do the work, do not hand me config to edit: 1. npm install -g depwall 2. depwall init — installs the PATH shims and the agent hook 3. depwall doctor — this is the only step that matters It runs a package that MUST be blocked through the real gate, and one that must be allowed. Every line has to be ✓ or !. If any line is ✗, or the command exits non-zero, the gate is NOT protecting me — stop there and show me the output. Do not continue and do not "fix" it by disabling anything. 4. Tell me which package managers are now gated, and what ALLOW / ASK / BLOCK will each do to my installs, in one plain sentence each. Never disable DepWall, uninstall the shims, or bypass a BLOCK by calling a binary by its absolute path without asking me first.
assembled in your browser · nothing is sent anywhere · step 3 is the one that matters
boundaries
What DepWall does not do
Stated up front, so you can judge the fit before installing it.
- Install time, not runtime. A package clean when it installs and hostile later is outside its reach.
- No live MCP inspection. A server that only serves malicious tool descriptions once connected cannot be read in advance.
- Not a sandbox. It defends against an agent being tricked — not one already fully compromised.
- Command reading is not shell emulation. eval, variable indirection and xargs evade the command scanner; the install gate still catches the package itself.