Skip to main content
Package Firewall blocks a package installation by returning an HTTP 403 error to your package manager, which stops the installation. The error names the reason the package was blocked, such as detected malware or a version that is newer than your organization’s minimum package age policy. Your security or platform team configures the Package Firewall policy that decides which installations are allowed. You see an error only when the policy blocks a package you request. If it is set to warn instead, the installation still proceeds and no error is shown. Both blocked and warned installations are recorded in the Package Firewall logs. Depending on the block reason, you can add an exception for the package, change the minimum age or vulnerability severity threshold, or update the restricted license list. To modify the policy, contact your security or platform team that manages it. Package Firewall evaluates each package version against the policy and blocks the installation when the version meets one of the following conditions: Each reason below shows the block response Package Firewall returns. Your package manager displays part of it in its error output.

​
Malware detected

The version matches a known malicious package in the Endor Labs malware database. Do not attempt to bypass this block or install the package another way. Report it to your security team so they can confirm the finding and check whether the package reached any other part of your environment.

​
Vulnerability detected

The version has a known vulnerability at a severity your policy blocks. Upgrade to a version that resolves the vulnerability.

​
Minimum package age not met

The version was published more recently than the minimum age your organization’s policy requires. The message states how old the version is and the age the policy requires. Wait until the version meets the required age, or install an older version that already meets it.

​
Restricted license

The version uses a license that your organization restricts. Install a version or an alternative package with an acceptable license.

​
All versions blocked

Every available version of the package is blocked by policy, so Package Firewall has no safe version to return. This happens when the policy is set to allow safe versions only and every version is flagged for malware or fails the minimum age policy.