Dependency Firewall
Block malicious packages before they enter your build
A read-only proxy for crates.io, npm, and PyPI that stops supply chain attacks at the registry. Every package request goes through three automated controls before reaching your build.
| Time | Decision | Package | Version | Evidence | |
|---|---|---|---|---|---|
| Nov 4, 10:11:59 AM | Block | Malware |  litellm | 1.107.0 | credential stealer |
| Nov 4, 10:11:58 AM | Allow | Artifact scan |  express | 5.1.0 | clean |
| Nov 4, 10:11:42 AM | Warn | Package age | vite | 7.2.0 | age < 1 week |
| Nov 4, 10:11:36 AM | Warn | Advisory | setuptools | 78.1.0 | GHSA-cx63-2mw6-8hw58.8+7 |
| Nov 4, 10:11:35 AM | Allow | Advisory |  libz-sys | 1.1.22 | RUSTSEC-2026-0418 |
| Nov 4, 10:11:35 AM | Allow | Artifact scan | serde | 1.0.228 | clean |
A credential stealer in LiteLLM, flagged 3 minutes after release
- 11:39:51First litellm 1.107.0 file uploaded to PyPI
- 11:43:05Dependency firewall flags the first wheel
- 12:00:06All 7 wheels flagged and blocked
- Follow-upPyPI quarantines the release
Secure your supply chain
Check 0101
Malware analysis
Any malware in here? AISLE's AI inspects each package, and every wheel, at machine speed.
Check 0202
Release age
Does the release meet your minimum age criteria? If not, it gets blocked.
Check 0303
Security advisories
Does the release meet your CVSS criteria? AISLE checks current OSV data to confirm.
Request decision
- Malware analysis
- Release age
- Security advisories
The package is served and the decision recorded.
Decisions you can verify
Enforce or monitor
Enforce mode fails closed: no verdict, no package. Monitoring mode serves packages and records every verdict, so you can measure impact before enforcing.
Precomputed verdicts
AISLE analyzes new releases of the packages you use, usually within minutes of publication. That way you can keep your pipeline moving.
Explainable decisions
Each audit record identifies the policy, evidence, and applicable exceptions. Malware findings cite the relevant file and line range.
Govern flexibly
Deployment-agnostic: Run AISLE's package firewall yourself, or let AISLE manage it.
The firewall removes denied versions from its package index. Package resolvers cannot select those versions.
GET /pypi/simple/litellm/ 1.106.1 1.106.2 1.107.0 removed · malware
Each exception applies to one advisory or one package-file hash. Each exception requires an expiry date and a written reason.
exception scope GHSA-xxxx-xxxx-xxxx expires 14 Nov 2026 reason Patched upstream, release pendingThe firewall records the user, time, policy, evidence, exceptions, ecosystem, package, and version for each decision.
decision user ci-runner@build-07 package npm · vite 7.2.0 policy min-age 72h result block
The firewall verifies the registry digest and calculates its own hash before it serves a package file. Each verdict applies to an exact file hash, not only to a version name.
serve registry digest verified local sha256 462d0c9f…a6fcf7 verdict bound to file hash
One registry change per client
Configure the firewall as an authenticated sparse registry that replaces crates.io.
More ecosystems are on the way. Tell AISLE which one you need.
[registries.aisle] index = "sparse+https://firewall.example.com/cargo/" [source.crates-io] replace-with = "aisle"
Works with the registry you already run
Point clients at the firewall directly, or keep your private registry and set the firewall as its upstream.
Clients use the firewall as their package registry. One registry change per client.
- Clientpip · npm · cargo
- Dependency firewallthree checks
- Public registryPyPI · npm · crates.io
Frequently asked questions
Known package files with a clean verdict are served from cache, without contacting AISLE. Unknown package files are held while a verdict is requested. If the configured time limit expires, the proxy returns HTTP 503 with a Retry-After header. In enforce mode: no verdict, no package. In monitoring mode, the package is served and the result recorded.
No. It processes public packages only, so it never accesses your source repositories. AISLE receives only the package name and version, and fetches the public file from the official registry itself.
Configure firewall rules that block direct access to public registries so developer and CI systems can reach packages only through the proxy.
Grant a controlled exception. Each exception applies to one advisory or one package-file hash, and requires an expiry date and a written reason.
crates.io through Cargo; npm through npm, pnpm, Yarn, and Bun; PyPI through uv, Poetry, and pip. Private registries such as JFrog Artifactory and Verdaccio can use the firewall as their upstream. AISLE is adding more package ecosystems. Contact AISLE to discuss support for yours.
You decide
AISLE enforces
Now in early access for crates.io, npm, and PyPI.