After LiteLLM's backdoor, we open-sourced an OS-level package firewall
Strix has released a Dependency Firewall tool that blocks malicious software packages before installation, available for macOS and Windows systems.
The Dependency Firewall operates by checking each package's name and version against Strix's malicious-package blocklist before installation. This screening happens directly on the user's device, with downloads going straight to the registry without passing through Strix servers. The tool provides protection across the entire system, blocking malicious packages before they can reach the machine.
Installation and Configuration
Users can install the tool machine-wide through a package file on macOS or an MSI installer on Windows. For command-prefix mode, installation is available via cargo, curl, or PowerShell. Configuration settings are stored in a config. file, with location varying by operating system. Only administrators can edit the machine-wide configuration.
The configuration allows customization of how long new versions are held back (default 24 hours), specifying exempt packages, adding custom registries, and enabling or disabling telemetry. By default, new packages are blocked since malware is typically detected within a day.
Security Features
New packages are blocked by default, since malware is usually detected within a day.
The tool provides up-to-the-minute data by constantly monitoring updates to top packages, covering 99% of installed packages. It consults multiple sources including OSSF's blocklist and OSV, as well as other public reports. When a potentially malicious package is detected, users receive alerts on macOS and Windows with the blocked package name and advisory link.
Related
