The Package Firewall is a policy proxy in front of 25 package registries. From the VDB console you set the thresholds, order your upstream mirrors, and review a full decision log of every package that passed, was blocked, or errored.
Security policies you control
Block by vulnerability severity
Every dependency request is checked against the Vulnetix VDB for known CVEs. If the highest CVSS v3 score on any CVE for that exact version meets or exceeds your threshold, the download is blocked before it reaches your machine.
Block by exploitation probability
EPSS, the Exploit Prediction Scoring System, measures how likely a vulnerability is to be exploited in the wild within the next 30 days. A CVE with CVSS 7.5 and EPSS 0.97 is more dangerous than one with CVSS 10.0 and EPSS 0.01. Scores update daily from FIRST.org.
Block by exploit availability probability
Coalition ESS reports Exploit Availability Probability: the likelihood that working exploit code becomes publicly available for threat actors to reuse. It answers whether an exploit is likely to be easy to find and operationalise, not just how severe the CVE is.
Block known malicious packages
blockMalware rejects any dependency flagged as a known malicious package before the module metadata even downloads. The VDB aggregates malware intelligence from OSSF Malicious Packages, OSV.dev malware advisories, and researcher-submitted samples, de-duplicated against a single corpus.
Block end-of-life dependencies
End-of-life packages accumulate unpatched CVEs: their maintainers have stopped issuing security fixes, so any new vulnerability becomes a permanent exposure. blockEol prevents teams from introducing EOL dependencies before they become a liability.
Block CISA Known Exploited Vulnerabilities
CISA KEV inclusion isn't a prediction, it's confirmation: these vulnerabilities are being actively exploited right now. US federal agencies must patch within 2–3 weeks of KEV listing; blockKev applies that same standard to your dependency pipeline automatically.
Block weaponized exploits
A weaponized exploit is attack code that is mature, reliable, and ready for adversarial use, no expertise required. Honeypot intelligence tracks when PoC code graduates from a researcher's lab to an operational weapon, the kind that powers ransomware and mass exploitation.
Block actively exploited vulnerabilities
blockActive blocks dependencies with confirmed active exploitation in the wild. CrowdSec tracks real attack traffic across millions of sensors globally; when a dependency's CVE shows up in live attack data, the proxy blocks it immediately.
Block when exploit code exists
A published proof-of-concept drastically lowers the barrier to exploitation: attackers can follow a recipe. The window between PoC publication and mass exploitation is measured in hours, not days. blockPoc closes that window for your dependency pipeline.
Block CVEs linked to bad actors
blockBadActors elevates the risk assessment when a vulnerability is associated with state-sponsored threat groups, criminal organisations, or actors with a documented track record of targeting open source supply chains. The same CVSS score means more when the attacker is a nation-state.
Delay newly published versions, carefully
Fast-follow supply chain attacks publish a malicious version seconds after a legitimate one, timed to catch automated upgrade scripts before the community notices. cooldownDays creates a time buffer, a hopeful freshness guard rather than proof of safety.
Avoid being first on a release
versionLag: N blocks a version unless at least N newer versions have been published. It is release-count-based rather than time-based, but it still only guesses that later releases create more scrutiny. It does not prove the older version is safe.
Across every ecosystem
Go, the pkg.go.dev API and Arch/AUR are free for the community; language, container and OS registries unlock on Pro and Enterprise. 25 registries are supported: