Skip to main content
This setup is a private package registry deployment. Artifactory sits between your package manager clients and Package Firewall. Configure JFrog Artifactory to use the Package Firewall URL as its remote source instead of public registries. Every package installation request flows through Endor Labs, so the Package Firewall can block known malicious packages before they reach your environment. The Package Firewall evaluates each package request based on the malware check and the configured Package Firewall policy conditions, and handles each request in one of three ways:
  • Block the installation and Artifactory returns HTTP 404 if the package is found in the Endor Labs malware database, or if a policy condition matches with Block. The Package Firewall records a log with the package, version, and reason.
  • Allow the installation if a policy condition matches with Warn. The Package Firewall records a warning log with the package, version, and reason.
  • Allow the installation if the package passes all checks. No log is recorded.
A policy change doesn’t apply to packages JFrog Artifactory has already cached until the cache expires. See Configure caching for time-sensitive policies to reduce that delay. Artifactory returns a generic HTTP 404 when it blocks a request without surfacing the specific reason. To see why a package was blocked, review the Package Firewall logs.
JFrog Artifactory requirementYou must have a JFrog Artifactory instance with permission to create remote repositories and configure credentials.

​
Configure the Package Firewall

Complete the following steps to integrate JFrog Artifactory with the Endor Labs Package Firewall:
  1. Create an API key for the Package Firewall.
  2. Configure JFrog Artifactory.
  3. Local setup for developers.
  4. Verify your setup.

​
Create an API key for the Package Firewall

Create an API key dedicated to the Package Firewall so that can authenticate to it. You can create it through one of the following methods:
  • Using the Endor Labs user interface, with the Package Firewall User role. See API keys to learn more.
  • Using endorctl, with the SYSTEM_ROLE_PACKAGE_FIREWALL role. Make sure to install and configure endorctl before you create the key.
To create the key using endorctl, run the following command and replace:
  • <namespace> with your namespace.
  • <API key name> with the name of the API key for the Package Firewall use case.
  • <YYYY-MM-DDTHH:MM:SSZ> with the API key expiration in ISO 8601 UTC format, for example 2026-12-31T23:59:59Z.
From the response, save the following values in a secure location. Use them as your Package Firewall credentials when you configure the JFrog Artifactory remote repository.
  • API key: spec.key
  • API secret: spec.secret

​
Configure JFrog Artifactory

Configure a remote repository in JFrog Artifactory for each package type you want to route through the Package Firewall. Use the steps below for npm, PyPI, or Go packages.
  1. Log in to JFrog Artifactory.
  2. Select Administration > Repositories from the left sidebar.
  3. Click Create a Repository and select Remote.
  4. Select npm as the package type.
  5. Enter a Repository Key, for example endor-firewall-npm.
  6. Enter the repository URL: https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/npm/. Replace <namespace> with your Endor Labs namespace.
  7. Enter the User Name and Password you saved when creating the API key.
  8. Click Create Remote Repository.
  1. Log in to JFrog Artifactory.
  2. Select Administration > Repositories from the left sidebar.
  3. Click Create a Repository and select Remote.
  4. Select PyPI as the package type.
  5. Enter a Repository Key, for example endor-firewall-pypi.
  6. Enter the repository URL: https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/pypi/. Replace <namespace> with your Endor Labs namespace.
  7. Enter the User Name and Password you saved when creating the API key.
  8. In PyPI Settings, set Registry URL to the same URL you entered in step 6.
  9. Click Create Remote Repository.
The Package Firewall uses a virtual repository URL that aggregates one or more Go remote repositories. Each remote repository routes Go module requests through the Package Firewall. The virtual repository gives clients a single endpoint that forwards each request to the matching remote repository. You can use a single virtual repository to link all Go remote repositories.To create a Go remote repository:
  1. Log in to JFrog Artifactory.
  2. Select Administration > Repositories from the left sidebar.
  3. Click Create a Repository and select Remote.
  4. Select Go as the package type.
  5. Enter a Repository Key, for example endor-firewall-go.
  6. Enter the repository URL: https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/go/. Replace <namespace> with your Endor Labs namespace.
  7. Enter the User Name and Password you saved when creating the API key.
  8. Click Create Remote Repository.
To create a virtual repository:
  1. Select Administration > Repositories from the left sidebar.
  2. Click Create a Repository and select Virtual.
  3. Select Go as the package type.
  4. Enter a Repository Key, for example endor-firewall-go-virtual.
  5. Under Repositories, select the remote repositories you want to add and click >.
  6. Click Create Virtual Repository.
Your Go remote and virtual repositories are now configured to route module requests through the Package Firewall.
  1. Log in to JFrog Artifactory.
  2. Select Administration > Repositories from the left sidebar.
  3. Click Create a Repository and select Remote.
  4. Select Maven as the package type.
  5. Enter a Repository Key, for example endor-firewall-maven.
  6. Enter the repository URL: https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/maven/. Replace <namespace> with your Endor Labs namespace.
  7. Enter the User Name and Password you saved when creating the API key.
  8. Disable Offline to allow Artifactory to fetch remote artifacts.
  9. Select Advanced and enable Store Artifacts Locally. Optionally, enable Priority Resolution to prioritize this repository over other repositories.
  10. Click Create Remote Repository.

​
Configure caching for time-sensitive policies

JFrog Artifactory serves cached package metadata without contacting the Package Firewall until the cache expires, so long cache periods delay when policy changes reach your developers. Lower Metadata Retrieval Cache Period (Sec) and Missed Retrieval Cache Period (Sec) on each remote repository you configured to apply changes faster. Lower values send more requests to the Package Firewall per installation, so balance responsiveness against request volume.
  1. Select Administration > Repositories from the left sidebar.
  2. Select the remote repository you configured for the Package Firewall.
  3. Select Advanced.
  4. In Metadata Retrieval Cache Period (Sec), enter a value between 30 and 60. This value controls how long Artifactory serves cached metadata before it fetches a fresh copy from the Package Firewall. JFrog Artifactory enforces a minimum of 30 seconds.
  5. In Missed Retrieval Cache Period (Sec), set a low value, around 30 to 60. This value controls how long Artifactory caches a not-found (HTTP 404) response, which includes a version blocked by a minimum package age condition that later becomes eligible.
  6. Click Save.

​
Local setup for developers

Update your package manager client to use Artifactory as its source, routing all installs through the Package Firewall instead of a public registry. Once you create the Artifactory remote:
  1. Select Administration > Repositories from the left sidebar.
  2. Click the vertical three dots next to the repository you configured and select Set Me Up. For Go, select the virtual repository you created.
  3. Enter Your JFrog account password if prompted.
  4. Click Generate Token & Create Instructions.
  5. Follow the instructions to configure your local machine based on your package type. Edit .npmrc for npm, pip.conf for pip, or settings.xml for Maven. For Go modules, select Resolve, copy the URL it provides, and run the following command. Replace <virtual-repository-url> with the copied URL. Ensure to URL-encode any @ in the username as %40.
    Refer to JFrog Artifactory documentation for more information.
  1. Run the following command to verify that your local client is pointing to the Artifactory repository. Ensure the output matches the Artifactory remote URL you configured, or the virtual repository URL for Go modules.
    • For npm packages, run npm config get registry.
    • For PyPI packages, run pip3 config list | grep index-url.
    • For Go modules, run go env GOPROXY.
    • For Maven packages, run mvn dependency:resolve -s settings.xml.

​
Verify your setup

To verify your setup, install a package that Endor Labs has classified as malware. The Package Firewall should block the installation and return an HTTP 404. The following are examples of packages classified as malware by Endor Labs.
Run the following command to test the Package Firewall with npm.
When the Package Firewall blocks the package, the output looks similar to the following. The E404 error code and 404 Not Found response confirm that the firewall blocked the package.
Run the following command to test the Package Firewall with pip.
When the Package Firewall blocks the package, the output looks similar to the following. The 404 response confirms that the firewall blocked the package.
Run the following command to test the Package Firewall with Go.
When the Package Firewall blocks the package, the output looks similar to the following. The 404 response confirms that the firewall blocked the package.
Add io.github.endorlabs:endor-java-webapp-demo:4.1 as a dependency in your pom.xml, then run the following command to test the Package Firewall with Maven.
When the Package Firewall blocks the package, the output looks similar to the following. JFrog Artifactory does not serve the artifact, so resolution fails with a missing POM warning and a Could not find artifact error.
After you confirm that the Package Firewall blocks malware, you can view the recorded events. See View Package Firewall logs to learn more.

​
Troubleshooting and FAQ

If Endor Labs flags a package as malware after Artifactory cached it, Artifactory continues to serve the cached metadata until the entry expires. Lower Metadata Retrieval Cache Period (Sec) on the remote repository to shorten that window. See Configure caching for time-sensitive policies to learn more.
  • Verify that the Package Firewall URL in Artifactory is correct.
  • Ensure network connectivity from Artifactory to the Package Firewall.
  • Ensure the firewall rules allow outbound connections from Artifactory.
  • Verify the API key and secret are correct and that the key has the Package Firewall User role.
  • Ensure that the credentials are in the format Artifactory expects.
  • Check the Artifactory logs for authentication errors.
  • Verify that Artifactory has sufficient storage for the cache.
  • Lower Metadata Retrieval Cache Period (Sec) and Missed Retrieval Cache Period (Sec) so more requests reach the Package Firewall. See Configure caching for time-sensitive policies.
  • Check the cache hit and miss rates. Clear the cache if you need to test with a fresh request.
A package blocked by a minimum package age condition returns an HTTP 404, which Artifactory caches in its missed-retrieval cache separately from package metadata. After the version becomes eligible, Artifactory can keep returning HTTP 404 until that entry expires. Lower Missed Retrieval Cache Period (Sec) on the remote repository so the change takes effect sooner. See Configure caching for time-sensitive policies.