install-time firewall · ai coding agents
Nothing installs unchecked.
DepWall inspects every package your agent pulls — before it lands. Deterministic signals resolve the common case in milliseconds; the gray zone goes to a judge.
$npm install -g depwall
Package scanner
idle
// awaiting target — pick one above or type a name
// signals run against the live verdict service
live · same engine the CLI runs · public coordinates only
21managers gated
16attack classes
72public fixtures
0rates claimed
threat model
What actually arrives with a dependency
Each row is an attack class with regression fixtures in the public corpus, and the signal that fires on it.
| Class | How it works | Signal |
|---|---|---|
| Slopsquat | An agent invents a plausible package name. An attacker registers it for real. Next time it's suggested, it resolves. | hallucinated-name slopsquat |
| Prompt injection | A README or manifest field carries instructions aimed at your agent, not you. Treated as evidence of attack, never as instruction. | llm-judge |
| Lockfile poisoning | A resolved URL quietly repointed at another host, or a tarball substituted under a legitimate name. | provenance |
| Install-time execution | Lifecycle scripts and build files that fetch and run code the moment you install — setup.py, build.rs, postinstall. | install-scripts build-scripts |
| Account takeover | A maintainer's token is stolen and a version published without the attested pipeline the previous releases used. | attestation |
| Brandjacking | A days-old package with no adoption, named to look like an established one. | maturity |
verdict contract
Three outcomes. Uncertainty is one of them.
No network, a registry outage, a truncated dependency tree, or an unknown package all resolve to ASK — never a silent pass. If the gate itself cannot run, the install does not proceed.
ALLOW
Nothing concerning found. The install proceeds and you never notice it happened.
ASK
Unresolved. DepWall stops and puts the decision in front of a human rather than guessing.
BLOCK
Critical evidence. The install stops before any of that package's code executes.
evidence
The corpus is public, including the misses
No detection rate is published
Any “99% caught” figure would be marketing. The fixtures are self-authored, so a percentage over them measures whether our tests agree with our own code — nothing more. A real number needs an independent corpus that does not exist yet.
One fixture is a documented failure
It stays in the corpus, in bold, on the evidence page. A security tool that lists only its wins is asking for trust it has not earned.
boundaries
What DepWall does not do
Stated up front, so you can judge the fit before installing it.
- Install time, not runtime. A package clean when it installs and hostile later is outside its reach.
- No live MCP inspection. A server that only serves malicious tool descriptions once connected cannot be read in advance.
- Not a sandbox. It defends against an agent being tricked — not one already fully compromised.
- Command reading is not shell emulation. eval, variable indirection and xargs evade the command scanner; the install gate still catches the package itself.