Skip to main content
Package Firewall sits between your package manager clients and public registries such as npmjs.com, pypi.org, pkg.go.dev, and Maven Central. You can put a private package registry in front of the firewall, or point clients at the firewall directly. Both models evaluate every request the same way. Package Firewall checks the package, then redirects the download to the public registry. It does not store artifact bytes.

​
Terms used in Package Firewall

The following table lists the terms used in Package Firewall.

​
Private package registry

Use this model if developers already install packages through JFrog Artifactory, Sonatype Nexus Repository, or Google Artifact Registry. Your private package registry uses Package Firewall as its remote source. Package manager clients keep talking to the registry they already use. The registry forwards each request to the firewall. Configure the registry you already run.

JFrog Artifactory

Point Artifactory remote repositories at Package Firewall.

Google Artifact Registry

Point Artifact Registry remote repositories at Package Firewall.

Sonatype Nexus Repository

Point Nexus proxy repositories at Package Firewall.

​
Package manager client

Use this model if you don’t run a private package registry, or if you want machines to talk to Package Firewall directly. You configure each package manager client with the Package Firewall URL and credentials. Do that by hand on each machine, or push the configuration with MDM. Choose how you configure the clients.

Direct integration

Configure npm, pip, uv, Yarn, Maven, and other clients to use Package Firewall.

MDM deployment

Push the same client configuration to developer machines with your MDM tool.

​
Compare the models

The following table summarizes how the two models differ. In both models, Package Firewall fetches packages from public registries.

​
Next steps

After you route traffic through Package Firewall, configure how it responds to flagged packages. See Package Firewall policy to set block, warn, and allow safe versions actions.