> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Understand blocked package responses

> Each Package Firewall block reason, what it means, and how to resolve it.

Package Firewall blocks a package installation by returning an `HTTP 403` error to your package manager, which stops the installation. The error names the reason the package was blocked, such as detected malware or a version that is newer than your organization's minimum package age policy.

Your security or platform team configures the [Package Firewall policy](/package-firewall/policy) that decides which installations are allowed. You see an error only when the policy blocks a package you request. If it is set to warn instead, the installation still proceeds and no error is shown. Both blocked and warned installations are recorded in the [Package Firewall logs](/package-firewall/logs). Depending on the block reason, you can add an exception for the package, change the minimum age or vulnerability severity threshold, or update the restricted license list. To modify the policy, contact your security or platform team that manages it.

Package Firewall evaluates each package version against the policy and blocks the installation when the version meets one of the following conditions:

* [Malware detected](#malware-detected)
* [Vulnerability detected](#vulnerability-detected)
* [Minimum package age not met](#minimum-package-age-not-met)
* [Restricted license](#restricted-license)
* [All versions blocked](#all-versions-blocked)

Each reason below shows the block response Package Firewall returns. Your package manager displays part of it in its error output.

### Malware detected

The version matches a known malicious package in the Endor Labs malware database. Do not attempt to bypass this block or install the package another way. Report it to your security team so they can confirm the finding and check whether the package reached any other part of your environment.

```json theme={null}
{
  "type": "https://docs.endorlabs.com/package-firewall/blocked-responses",
  "title": "Package blocked by Endor Labs Package Firewall",
  "status": 403,
  "detail": "malware detected in endor-firewall-test@1.0.0; see https://app.endorlabs.com/t/acme/package-firewall",
  "instance": "/v1/namespaces/acme/firewall/npm/endor-firewall-test/-/endor-firewall-test-1.0.0.tgz",
  "error": "blocked by Endor Labs: malware detected in endor-firewall-test@1.0.0 - see https://app.endorlabs.com/t/acme/package-firewall",
  "code": "MALWARE_DETECTED",
  "reason": "malware detected for package endor-firewall-test@1.0.0"
}
```

### Vulnerability detected

The version has a known vulnerability at a severity your policy blocks. Upgrade to a version that resolves the vulnerability.

```json theme={null}
{
  "type": "https://docs.endorlabs.com/package-firewall/blocked-responses",
  "title": "Package blocked by Endor Labs Package Firewall",
  "status": 403,
  "detail": "endor-firewall-test@1.0.0 has a CRITICAL severity vulnerability at or above the configured threshold; see https://app.endorlabs.com/t/acme/package-firewall",
  "instance": "/v1/namespaces/acme/firewall/npm/endor-firewall-test/-/endor-firewall-test-1.0.0.tgz",
  "error": "blocked by Endor Labs: endor-firewall-test@1.0.0 has a CRITICAL severity vulnerability at or above the configured threshold - see https://app.endorlabs.com/t/acme/package-firewall",
  "code": "CVSS_SEVERITY_DETECTED",
  "reason": "vulnerability severity detected for package endor-firewall-test@1.0.0"
}
```

### Minimum package age not met

The version was published more recently than the minimum age your organization's policy requires. The message states how old the version is and the age the policy requires. Wait until the version meets the required age, or install an older version that already meets it.

```json theme={null}
{
  "type": "https://docs.endorlabs.com/package-firewall/blocked-responses",
  "title": "Package blocked by Endor Labs Package Firewall",
  "status": 403,
  "detail": "endor-firewall-test@1.0.0 is 4 hours old and the policy requires 72 hours; see https://app.endorlabs.com/t/acme/package-firewall",
  "instance": "/v1/namespaces/acme/firewall/npm/endor-firewall-test/-/endor-firewall-test-1.0.0.tgz",
  "error": "blocked by Endor Labs: endor-firewall-test@1.0.0 is 4 hours old and the policy requires 72 hours - see https://app.endorlabs.com/t/acme/package-firewall",
  "code": "MIN_AGE_NOT_MET",
  "reason": "package does not meet min_age_hours requirement"
}
```

### Restricted license

The version uses a license that your organization restricts. Install a version or an alternative package with an acceptable license.

```json theme={null}
{
  "type": "https://docs.endorlabs.com/package-firewall/blocked-responses",
  "title": "Package blocked by Endor Labs Package Firewall",
  "status": 403,
  "detail": "endor-firewall-test@1.0.0 uses license GPL-3.0-only, which the policy restricts; see https://app.endorlabs.com/t/acme/package-firewall",
  "instance": "/v1/namespaces/acme/firewall/npm/endor-firewall-test/-/endor-firewall-test-1.0.0.tgz",
  "error": "blocked by Endor Labs: endor-firewall-test@1.0.0 uses license GPL-3.0-only, which the policy restricts - see https://app.endorlabs.com/t/acme/package-firewall",
  "code": "RESTRICTED_LICENSE",
  "reason": "restricted license detected for package endor-firewall-test@1.0.0"
}
```

### All versions blocked

Every available version of the package is blocked by policy, so Package Firewall has no safe version to return. This happens when the policy is set to allow safe versions only and every version is flagged for malware or fails the minimum age policy.

```json theme={null}
{
  "type": "https://docs.endorlabs.com/package-firewall/blocked-responses",
  "title": "Package blocked by Endor Labs Package Firewall",
  "status": 403,
  "detail": "every available version of endor-firewall-test is blocked by policy; see https://app.endorlabs.com/t/acme/package-firewall",
  "instance": "/v1/namespaces/acme/firewall/npm/endor-firewall-test/-/endor-firewall-test-1.0.0.tgz",
  "error": "blocked by Endor Labs: every available version of endor-firewall-test is blocked by policy - see https://app.endorlabs.com/t/acme/package-firewall",
  "code": "VERSIONS_CURATED",
  "reason": "all versions curated for package endor-firewall-test"
}
```