> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Package Firewall
> Block known malicious packages and control package installations in real time with Endor Labs Package Firewall.
export const LicenseBadge = ({sku, skus, relation = 'any'}) => {
const DATA_URL = '/snippets/license-sku-data.json';
const CACHE_KEY = 'license-sku-data';
const CACHE_TTL_MS = 60 * 60 * 1000;
const REGISTRY_KEY = '__licenseSkuRegistry';
const FALLBACK_LICENSES_URL = '/introduction/licenses';
const ACCENT = '#26D07C';
const CONJUNCTION = {
any: 'or',
all: 'and'
};
const FONT_STACK = '-apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif';
const [isDark, setIsDark] = useState(false);
const [data, setData] = useState(null);
const [hasFetchError, setHasFetchError] = useState(false);
const skuList = useMemo(() => {
if (Array.isArray(skus) && skus.length > 0) {
return skus.filter(code => typeof code === 'string' && code.trim()).map(c => c.trim());
}
if (typeof sku === 'string' && sku.trim()) {
return [sku.trim()];
}
return [];
}, [sku, skus]);
useEffect(() => {
const check = () => {
const root = document.documentElement;
setIsDark(root.dataset.theme === 'dark' || root.classList.contains('dark'));
};
check();
const observer = new MutationObserver(check);
observer.observe(document.documentElement, {
attributes: true,
attributeFilter: ['data-theme', 'class']
});
return () => observer.disconnect();
}, []);
useEffect(() => {
let cancelled = false;
const readCache = () => {
try {
const raw = sessionStorage.getItem(CACHE_KEY);
if (!raw) return null;
const parsed = JSON.parse(raw);
if (Date.now() - parsed.ts > CACHE_TTL_MS) {
sessionStorage.removeItem(CACHE_KEY);
return null;
}
return parsed.data;
} catch (e) {
return null;
}
};
const writeCache = value => {
try {
sessionStorage.setItem(CACHE_KEY, JSON.stringify({
ts: Date.now(),
data: value
}));
} catch (e) {}
};
const fetchSkuData = async () => {
const cached = readCache();
if (cached) return cached;
if (!globalThis[REGISTRY_KEY]) {
globalThis[REGISTRY_KEY] = {};
}
const registry = globalThis[REGISTRY_KEY];
if (registry[CACHE_KEY]) return registry[CACHE_KEY];
const promise = (async () => {
const resp = await fetch(DATA_URL);
if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
const json = await resp.json();
writeCache(json);
return json;
})();
registry[CACHE_KEY] = promise;
promise.finally(() => {
delete registry[CACHE_KEY];
});
return promise;
};
fetchSkuData().then(d => {
if (!cancelled) setData(d);
}).catch(() => {
if (!cancelled) setHasFetchError(true);
});
return () => {
cancelled = true;
};
}, []);
const textColor = isDark ? '#e6edf3' : '#1f2937';
const textMuted = isDark ? 'rgba(230,237,243,0.65)' : 'rgba(31,41,55,0.65)';
const bannerBackground = isDark ? '#161b22' : '#f6f8fa';
const borderColor = isDark ? 'rgba(38,208,124,0.35)' : 'rgba(38,208,124,0.45)';
const linkColor = isDark ? '#4ade80' : '#047857';
const errorBackground = isDark ? '#3b1111' : '#fef2f2';
const errorBorder = isDark ? '#7f1d1d' : '#fecaca';
const errorText = isDark ? '#fecaca' : '#7f1d1d';
const licensesUrl = data?.licensesPageUrl || FALLBACK_LICENSES_URL;
const resolveSkuName = code => {
const entry = data?.skus?.[code];
if (entry?.name) return entry.name;
return null;
};
const formatSkuLabel = code => {
const name = resolveSkuName(code);
if (name) return name;
return code;
};
const joinWithConjunction = (codes, conjunction) => {
const labels = codes.map(formatSkuLabel);
if (labels.length === 0) return '';
if (labels.length === 1) return labels[0];
if (labels.length === 2) return `${labels[0]} ${conjunction} ${labels[1]}`;
const head = labels.slice(0, -1).join(', ');
const tail = labels[labels.length - 1];
return `${head}, ${conjunction} ${tail}`;
};
const buildSkuSentence = codes => {
const conj = CONJUNCTION[relation] || CONJUNCTION.any;
const names = joinWithConjunction(codes, conj);
const noun = codes.length > 1 ? 'licenses' : 'license';
return `${names} ${noun}`;
};
const renderLink = text =>
{text} →
;
const renderBanner = codes =>
Requires
{buildSkuSentence(codes)}
{renderLink('Licenses')}
;
const renderLoading = () =>
Loading license info…
;
const renderInputError = message =>
{message}
;
if (typeof sku === 'string' && Array.isArray(skus)) {
return renderInputError('LicenseBadge: pass either `sku` or `skus`, not both.');
}
if (skuList.length === 0) {
return renderInputError('LicenseBadge: `sku` or `skus` is required.');
}
if (hasFetchError) return renderBanner(skuList);
if (!data) return renderLoading();
return renderBanner(skuList);
};
Package Firewall offers real-time protection against malicious packages during software installations. It safeguards your software supply chain by preventing malicious packages from reaching your developers. Positioned between package managers and public package registries, it blocks the installation of known malicious packages by default while allowing safe packages to install normally.
Security teams often discover malware only after it enters your environment, forcing reactive cleanup. Package Firewall closes this gap by intercepting every package installation request before it completes. It blocks any malicious package instantly and returns an error, so the package never reaches your environment. Legitimate packages pass through unchanged, keeping your developers productive and your pipeline secure.
Package Firewall checks every package in the dependency tree individually, including transitive dependencies. If it flags any dependency, the installation is blocked. Configured policies apply to transitive dependencies as well. See [How it works](#how-it-works) for more details.
## Get started
Choose the integration that fits your environment: [JFrog Artifactory](/package-firewall/jfrog-artifactory), [direct integration](/package-firewall/direct-integration), or [deploy to developer machines with MDM](/package-firewall/mdm-deployment).
Define how the firewall responds to flagged packages: block or warn on malware, vulnerabilities, restricted licenses, and minimum package age, and set exceptions. See [Package Firewall policy](/package-firewall/policy).
Confirm the firewall blocks malware and review every recorded event. See [View Package Firewall logs](/package-firewall/logs).
## How it works
Package Firewall inspects each package request before the package is downloaded. When a developer or CI pipeline requests a package, the request routes through the firewall, either directly or through a private registry such as JFrog Artifactory.
1. **Route traffic through Package Firewall**: Your package manager or private registry forwards each request to the firewall so that it evaluates every package before the download completes.
2. **Authenticate and control access**: Package Firewall verifies that each request presents an Endor Labs API key with the Package Firewall User role.
3. **Evaluate each package request**: For each request, Package Firewall parses the ecosystem, package name, and version, and checks it against the Endor Labs malware database. If you configure a [Package Firewall policy](/package-firewall/policy), the firewall also evaluates vulnerabilities, restricted licenses, and minimum package age. You can define exceptions that let specific packages bypass all checks, so critical builds and workflows continue uninterrupted.
4. **Take action**: Based on the malware check and policy conditions, Package Firewall takes the configured action on the request and records an event with the package, version, and reason. You can set each condition (malware, vulnerabilities, restricted licenses, and minimum package age) to one of two responses:
* **Warn**: Records the event and allows the package installation without interrupting your CI pipeline.
* **Block**: Prevents the package installation entirely and returns an error.
When a package passes all checks, the installation proceeds and no log is recorded.
5. **Record events in Package Firewall logs**: Package Firewall records the actions the firewall takes on package installation requests, which is helpful for debugging and compliance. The logs include details such as the package, version, time of the event, and the reason the firewall flagged the package. See [View Package Firewall logs](/package-firewall/logs) for more details.