Configure the Package Firewall with Sonatype Nexus Repository

This setup is a private package registry deployment. Nexus Repository sits between your package manager clients and Package Firewall. Configure Sonatype Nexus Repository to use the Package Firewall URL as the remote storage for a proxy repository instead of public registries. Every package installation request flows through Endor Labs, so Package Firewall can block known malicious packages before they reach your environment. Package Firewall evaluates each package request based on the malware check and the configured Package Firewall policy conditions, and handles each request in one of the following methods:

Block the installation if the package is found in the Endor Labs malware database, or if a policy condition matches with Block. Nexus Repository returns HTTP 404 response. Package Firewall records a log with the package, version, and reason.
Allow the installation if a policy condition matches with Warn. Package Firewall records a warning log with the package, version, and reason.
Allow the installation if the package passes all checks. No log is recorded.

A Package Firewall policy change doesn’t take effect immediately for packages Nexus Repository has already cached. Nexus Repository serves cached content without contacting Package Firewall, so a cached package keeps its earlier outcome until the entry expires or you invalidate it. A package cached before Endor Labs flagged it as malware continues to install, and a package blocked before you added an exception remains blocked. Configure a shorter cache lifetime in your repository settings to make policy changes take effect sooner and send more requests to Package Firewall. For more information, refer to Configurable repository fields. Nexus Repository returns a generic HTTP 404 response when it blocks a request without surfacing the specific reason. To see why a package was blocked, review the Package Firewall logs.

Sonatype Nexus Repository requirementYou must have a Sonatype Nexus Repository instance with permission to create proxy repositories and configure credentials.

Configure the Package Firewall

Complete the following steps to integrate Sonatype Nexus Repository with the Endor Labs Package Firewall:

Create an API key for the Package Firewall.
Configure Sonatype Nexus Repository.
Set up local package manager clients.
Verify your setup.

If you use Endor Labs with an EU tenant, use https://factory.eu.endorlabs.com instead of https://factory.endorlabs.com.

Create an API key for the Package Firewall

Create an API key dedicated to the Package Firewall so that Sonatype Nexus Repository can authenticate to it. You can create it through one of the following methods:

Using the Endor Labs user interface, with the Package Firewall User role. See API keys to learn more.
Using endorctl, with the SYSTEM_ROLE_PACKAGE_FIREWALL role. Make sure to install and configure endorctl before you create the key.

To create the key using endorctl, run the following command and replace:

<namespace> with your namespace.
<API key name> with the name of the API key for the Package Firewall use case.
<YYYY-MM-DDTHH:MM:SSZ> with the API key expiration in ISO 8601 UTC format, for example 2026-12-31T23:59:59Z.

export NAMESPACE="<namespace>"
export KEY_NAME="<API key name>"

endorctl api create -r APIKey -n "$NAMESPACE" --data '{
  "meta": { "name": "'"$KEY_NAME"'" },
  "spec": {
    "permissions": { "roles": ["SYSTEM_ROLE_PACKAGE_FIREWALL"] },
    "expiration_time": "<YYYY-MM-DDTHH:MM:SSZ>"
  },
  "propagate": true
}'

From the response, save the following values in a secure location. Use them as your Package Firewall credentials when you configure the Nexus Repository proxy repository.

API key: spec.key
API secret: spec.secret

Configure Sonatype Nexus Repository

Configure a proxy repository in Nexus Repository for each package type you want to route through the Package Firewall. A proxy repository fetches artifacts from an upstream source, so you set the Package Firewall URL as the remote storage. The remaining repository settings, such as blob store and cleanup policies, are specific to Nexus Repository. Configure them based on your requirements.

Configure Nexus Repository for an npm proxy repository

Sign in to Sonatype Nexus Repository.
Select Settings > Repository > Repositories.
Click Create repository.
Select npm (proxy) as the recipe.
Enter the repository name, such as endor-firewall-npm.
In Remote Storage, enter https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/npm/. Replace <namespace> with your Endor Labs namespace.
Select Authentication under HTTP Authentication.
In Authentication type, choose Username.
Enter the API key as the Username and the API secret as the Password.
Click Create repository.

Configure Nexus Repository for a PyPI proxy repository

Sign in to Sonatype Nexus Repository.
Select Settings > Repository > Repositories.
Click Create repository.
Select pypi (proxy) as the recipe.
Enter the repository name, such as endor-firewall-pypi.
In Remote Storage, enter https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/pypi/. Replace <namespace> with your Endor Labs namespace.
Select Authentication under HTTP Authentication.
In Authentication type, choose Username.
Enter the API key as the Username and the API secret as the Password.
Click Create repository.

Configure Nexus Repository for a Go proxy repository

Sign in to Sonatype Nexus Repository.
Select Settings > Repository > Repositories.
Click Create repository.
Select go (proxy) as the recipe.
Enter the repository name, such as endor-firewall-go.
In Remote Storage, enter https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/go/. Replace <namespace> with your Endor Labs namespace.
Select Authentication under HTTP Authentication.
In Authentication type, choose Username.
Enter the API key as the Username and the API secret as the Password.
Click Create repository.

To give clients a single endpoint that resolves across multiple Go proxy repositories, create a go (group) repository and add endor-firewall-go as a member. For more information, refer to Repository types.

Configure Nexus Repository for a Maven proxy repository

Sign in to Sonatype Nexus Repository.
Select Settings > Repository > Repositories.
Click Create repository.
Select maven2 (proxy) as the recipe.
Enter the repository name, such as endor-firewall-maven.
In Remote Storage, enter https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/maven/. Replace <namespace> with your Endor Labs namespace.
Select Authentication under HTTP Authentication.
In Authentication type, choose Username.
Enter the API key as the Username and the API secret as the Password.
Click Create repository.

If you have a Maven group repository that combines multiple repositories, make sure no other member proxies Maven Central directly. Nexus Repository returns the first member that has the component, so a member with its own path to the public registry serves packages Package Firewall blocked.

Configure Nexus Repository for a NuGet proxy repository

Sign in to Sonatype Nexus Repository.
Select Settings > Repository > Repositories.
Click Create repository.
Select nuget (proxy) as the recipe.
Enter the repository name, such as endor-firewall-nuget.
In Protocol version, choose NuGet V3.
In Remote Storage, enter https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/nuget/v3/index.json. Replace <namespace> with your Endor Labs namespace.
Select Authentication under HTTP Authentication.
In Authentication type, choose Username.
Enter the API key as the Username and the API secret as the Password.
Click Create repository.

Set up local package manager clients

Update your package manager client to use the Nexus Repository proxy repository as its source, routing all package installations through Package Firewall instead of a public registry. Nexus Repository serves each repository at https://<nexus-host>/repository/<repository-name>/. Replace <nexus-host> with your Nexus Repository host, and the port if your instance uses one, such as nexus.example.com:8081. Replace <repository-name> with the repository you created. Each example includes the credentials to add when your proxy repository requires authentication. Omit them if your proxy repository allows anonymous read access. Replace <nexus-username> and <nexus-password> with your Nexus Repository credentials, not the Endor Labs API key and secret stored on the proxy repository.

npm

Run the following command to point npm at the proxy repository.

npm config set registry https://<nexus-host>/repository/endor-firewall-npm/

If your proxy repository requires authentication, encode your credentials as a Base64 string.

echo -n "<nexus-username>:<nexus-password>" | base64

Add the following lines to your .npmrc file at the project level, or in the user-level file at ~/.npmrc. Replace <base64-credentials> with the string you generated.

//<nexus-host>/repository/endor-firewall-npm/:_auth=<base64-credentials>
always-auth=true

Run npm config get registry to confirm the registry matches the repository URL.For more information, refer to npm registry documentation.

pip

Add the following lines to your pip.conf file.

[global]
index-url = https://<nexus-host>/repository/endor-firewall-pypi/simple

If your proxy repository requires authentication, include your credentials in the index URL.

[global]
index-url = https://<nexus-username>:<nexus-password>@<nexus-host>/repository/endor-firewall-pypi/simple

Run pip3 config list | grep index-url to confirm the index URL matches the repository URL.For more information, refer to Configure PyPI with Nexus.

Run the following command to point the Go module proxy at the repository.

go env -w GOPROXY=https://<nexus-host>/repository/endor-firewall-go/

If your proxy repository requires authentication, Go reads your credentials from a .netrc file rather than from the proxy URL.Run go env GOPROXY to confirm the proxy matches the repository URL.For more information, refer to Configure Go with Nexus.

Maven

Add a mirror to your ~/.m2/settings.xml file that points at the proxy repository. If your proxy repository requires authentication, add a server with the same <id> as the mirror.

<settings>
  <mirrors>
    <mirror>
      <id>endor-firewall</id>
      <name>Endor Package Firewall</name>
      <mirrorOf>central</mirrorOf>
      <url>https://<nexus-host>/repository/endor-firewall-maven/</url>
    </mirror>
  </mirrors>
  <servers>
    <server>
      <id>endor-firewall</id>
      <username><nexus-username></username>
      <password><nexus-password></password>
    </server>
  </servers>
</settings>

Run mvn dependency:resolve to confirm Maven resolves through the mirror.For more information, refer to Maven repository documentation.

NuGet

Add the following to your nuget.config file to point NuGet at the proxy repository. If your proxy repository requires authentication, add the credentials as shown, otherwise skip the packageSourceCredentials block.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="endor-firewall" value="https://<nexus-host>/repository/endor-firewall-nuget/index.json" protocolVersion="3" />
  </packageSources>
  <packageSourceCredentials>
    <endor-firewall>
      <add key="Username" value="<nexus-username>" />
      <add key="ClearTextPassword" value="<nexus-password>" />
    </endor-firewall>
  </packageSourceCredentials>
</configuration>

For more information, refer to NuGet repository documentation.

Verify your setup

To verify your setup, install a package that Endor Labs has classified as malware. Package Firewall should block the installation and return an HTTP 404. The following are examples of packages classified as malware by Endor Labs.

npm

Run the following command to test Package Firewall with npm.

npm install endor-firewall-test@1.0.0

When Package Firewall blocks the package, the output looks similar to the following. The E404 error code and 404 Not Found response confirm that the firewall blocked the package.

npm error code E404
npm error 404 Not Found - GET https://nexus.example.com/repository/endor-firewall-npm/endor-firewall-test/-/endor-firewall-test-1.0.0.tgz - Package 'endor-firewall-test' not found
npm error 404
npm error 404 'endor-firewall-test@https://nexus.example.com/repository/endor-firewall-npm/endor-firewall-test/-/endor-firewall-test-1.0.0.tgz' is not in this registry.
npm error 404
npm error 404 Note that you can also install from a
npm error 404 tarball, folder, http url, or git url.

pip

Run the following command to test Package Firewall with pip.

pip3 install endor-firewall-test==1.0.0

When Package Firewall blocks the package, the output looks similar to the following. The 404 response confirms that the firewall blocked the package.

Looking in indexes: https://nexus.example.com/repository/endor-firewall-pypi/simple
Collecting endor-firewall-test==1.0.0
  ERROR: HTTP error 404 while getting https://nexus.example.com/repository/endor-firewall-pypi/packages/endor-firewall-test/1.0.0/endor_firewall_test-1.0.0-py3-none-any.whl#sha256=4df734939186708c595e72e50f5d31296d2ea9e54d5a0afc9e69d4e7d6f0d4b9 (from https://nexus.example.com/repository/endor-firewall-pypi/simple/endor-firewall-test/) (requires-python:>=3.7)

ERROR: Could not install requirement endor-firewall-test==1.0.0 from https://nexus.example.com/repository/endor-firewall-pypi/packages/endor-firewall-test/1.0.0/endor_firewall_test-1.0.0-py3-none-any.whl#sha256=4df734939186708c595e72e50f5d31296d2ea9e54d5a0afc9e69d4e7d6f0d4b9 because of HTTP error 404 Client Error: Not Found for url: https://nexus.example.com/repository/endor-firewall-pypi/packages/endor-firewall-test/1.0.0/endor_firewall_test-1.0.0-py3-none-any.whl (from https://nexus.example.com/repository/endor-firewall-pypi/simple/endor-firewall-test/) (requires-python:>=3.7)

Run the following command to test Package Firewall with Go.

go install github.com/endorlabstest/endor-firewall-test@v1.0.0

When Package Firewall blocks the package, the output looks similar to the following. The 404 response confirms that the firewall blocked the package.

go: github.com/endorlabstest/endor-firewall-test@v1.0.0: reading https://nexus.example.com/repository/endor-firewall-go/github.com/endorlabstest/endor-firewall-test/@v/v1.0.0.info: 404

Maven

Add io.github.endorlabs:endor-java-webapp-demo:4.1 as a dependency in your pom.xml, then run the following command to test Package Firewall with Maven.

mvn dependency:resolve

When Package Firewall blocks the package, the output looks similar to the following. Nexus Repository doesn’t serve the artifact, so resolution fails with a missing POM warning and a Could not find artifact error.

[INFO] Scanning for projects...
[INFO]
[INFO] -----------------------< com.example:my-app >------------------------
[INFO] Building my-app 1.0.0
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
Downloading from endor-firewall: https://nexus.example.com/repository/endor-firewall-maven/io/github/endorlabs/endor-java-webapp-demo/4.1/endor-java-webapp-demo-4.1.pom
[WARNING] The POM for io.github.endorlabs:endor-java-webapp-demo:jar:4.1 is missing, no dependency information available
Downloading from endor-firewall: https://nexus.example.com/repository/endor-firewall-maven/io/github/endorlabs/endor-java-webapp-demo/4.1/endor-java-webapp-demo-4.1.jar
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  4.000 s
[INFO] Finished at: 2026-06-09T14:11:11Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal on project my-app: Could not resolve dependencies for project com.example:my-app:jar:1.0.0
[ERROR] dependency: io.github.endorlabs:endor-java-webapp-demo:jar:4.1 (compile)
[ERROR] 	Could not find artifact io.github.endorlabs:endor-java-webapp-demo:jar:4.1 in endor-firewall (https://nexus.example.com/repository/endor-firewall-maven)
[ERROR]

NuGet

Run the following command to test Package Firewall with NuGet.

dotnet add package newtonsoft.json.bson --version 1.0.3 --source https://nexus.example.com/repository/endor-firewall-nuget/index.json

When Package Firewall blocks the package, you will see a 404 response confirming that the firewall blocked the package.

After you confirm that Package Firewall blocks malware, you can view the recorded events. See View Package Firewall logs to learn more.

Troubleshooting and FAQ

What if Nexus Repository has already cached a package that is declared malicious later?

If Endor Labs flags a package as malware after Nexus Repository cached it, Nexus Repository continues to serve it until the cache expires. Reduce the component and metadata maximum age on the proxy repository to shorten that window.

Why does a package stay blocked after I add an exception?

Nexus Repository caches negative responses in its not found cache. After Package Firewall starts allowing a package, Nexus Repository can keep returning HTTP 404 until that entry expires. Invalidate the cache on the proxy repository to pick up the change immediately.

How do I troubleshoot connection issues?

Verify that the Package Firewall URL in the proxy repository remote storage is correct.
Ensure network connectivity from Nexus Repository to Package Firewall.
Ensure your network firewall rules allow outbound connections from Nexus Repository.

How do I troubleshoot authentication issues?

Verify the API key and secret are correct and that the key has the Package Firewall User role.
Confirm that Authentication is selected on the proxy repository and that the credentials are saved.
Check the Nexus Repository logs for authentication errors.

Introduction

Set up

Configure

Operate

Configure the Package Firewall with Sonatype Nexus Repository

Configure the Package Firewall

Create an API key for the Package Firewall

Configure Sonatype Nexus Repository

Set up local package manager clients

Verify your setup

Troubleshooting and FAQ

​Configure the Package Firewall

​Create an API key for the Package Firewall

​Configure Sonatype Nexus Repository

​Set up local package manager clients

​Verify your setup

​Troubleshooting and FAQ

Configure the Package Firewall

Create an API key for the Package Firewall

Configure Sonatype Nexus Repository

Set up local package manager clients

Verify your setup

Troubleshooting and FAQ