Learn

Questions and answers

What is a package firewall, and do I need one?

A package firewall is a registry proxy between your package managers and the public registries, which refuses a malicious, typosquatted or policy-violating package before the package installs. A team needs one when developers, CI jobs or coding agents install open-source packages straight from npm, PyPI, Maven, Go, Cargo or Docker registries. The reason is timing: an install script runs the moment a package lands, before any vulnerability scanner reads the code. The March 2026 axios compromise was a maintainer-account takeover with an install-time dropper, so the damage happened at install. A scanner reports on packages already installed, while a package firewall decides on the install request itself. Chainsaw, the package firewall from Chain305, covers 16 ecosystems and checks up to 25 supply-chain signals per package. What is a package firewall? explains how a package firewall works, what one catches and what one misses, with our measured block and false-block rates.

How do I stop malicious packages today?

You stop malicious packages today by hardening the package-manager settings you already have, then adding a package firewall for what the settings miss. On npm, ignore-scripts stops install scripts from running and min-release-age holds brand-new versions. On Python, pip, uv and Poetry can require wheels, hashes and a release-age cutoff. No setting judges what a package does, which is the gap a firewall covers. The guides below give the exact settings per ecosystem:

• How to block malicious npm packages: ignore-scripts, min-release-age, npm ci, scoped registries and signature checks, and where a firewall fits on top.
• Typosquatting: how lookalike package names work, two real cases, and how detection catches them.
• Slopsquatting: package names that AI coding tools invent and attackers then register.
• How to block malicious PyPI packages: pip, uv and Poetry settings: wheels only, hashes, release-age cutoffs and index order.
• Dependency confusion: how a public package takes the place of a private one, and the fixes per ecosystem.
• Maven, Go and Cargo settings: mirrors and checksums, the Go checksum database, Cargo.lock and source replacement.
• Install script attacks: where npm, PyPI, Cargo and Composer run code at install time, the 2026 attacks that used each hook, and what the settings miss.
• Maintainer account takeover: how hijacked accounts, stolen tokens and trusted publishing shipped malicious releases in 2026, and the signals and holds that buy time against them.

Can I run it inside my own network?

Yes. Chainsaw runs inside your own network as a paid self-hosted deployment: in your VPC, on-premises or fully air-gapped, from the same binary as the SaaS version. In air-gapped mode, CHAINSAW_OFFLINE=1 makes no outbound connections, and threat data arrives as an intelligence bundle whose digest is verified at start. Policy bundles are verified with Sigstore when they load. Audit rows, exceptions and policy versions live in your own Postgres, so install decisions never leave your boundary. Self-hosted and air-gapped deployment is part of the Enterprise plan, which starts at $36,000 a year and is the same software as the hosted plans. The free Chainsaw CLI also runs locally with no account and refuses known-malicious packages and typosquats offline. Self-hosted package firewall covers running Chainsaw in your VPC, on-premises or fully air-gapped.

How does Chainsaw compare with other tools?

• Socket vs Chainsaw: two install-time firewalls, where each is stronger.
• GitHub package firewall vs Chainsaw: GitHub’s npm firewall for Enterprise Cloud, and where the two differ.
• DepGate vs Chainsaw: an MIT-licensed self-hosted dependency gateway, and where the two differ.
• Endor Labs vs Chainsaw: Endor Labs Package Firewall inside an AppSec platform, and where the two differ.
• Aikido Safe Chain vs Chainsaw: Aikido’s free npm and PyPI install guard, and where the two differ.
• SafeDep PMG vs Chainsaw: SafeDep’s free package-manager guard with an install sandbox, and where the two differ.
• Bytesafe vs Chainsaw: Bytesafe’s EU-hosted dependency firewall, and where the two differ.
• JFrog Curation alternatives: when Curation fits and what else blocks at install.
• Sonatype Repository Firewall alternatives: when Repository Firewall fits and what else blocks at install.
• Where Chainsaw fits: the whole category on one page.

What did real attacks look like?

Real package attacks in 2026 were mostly hijacked maintainer accounts, stolen publish tokens and lookalike names, and the malicious code ran at install, import or build time. The pattern is the same across npm, PyPI, crates.io and Composer: an attacker gains publish rights or registers a near-copy of a real name, ships a version with a dropper or credential stealer, and waits for installs. We analyzed 17 of those attacks in depth. Each teardown covers how the malicious package got in and whether Chainsaw would have stopped the package.

• Mini Shai-Hulud and the TanStack npm compromise: the May 2026 worm published through hijacked trusted publishing.
• The axios npm compromise: the March 2026 maintainer-account takeover and its install-time dropper.
• The LiteLLM PyPI compromise: malicious 1.82.7 and 1.82.8 and the .pth file that ran at Python startup.
• The Bitwarden CLI npm compromise: a malicious @bitwarden/cli 2026.4.0 published through Bitwarden’s own CI.
• The Trivy tag hijack: a malicious Trivy 0.69.4 and force-pushed trivy-action tags that read CI secrets.
• GlassWorm: malware hidden in invisible Unicode across npm, GitHub and VS Code.
• arrayref and proc-macro1: a typosquat crate added to three crates.io packages, run at build time.
• The Telnyx PyPI compromise: a credential stealer hidden in a WAV file, run when the package was imported.
• The node-ipc compromise: an expired email domain that likely handed over a dormant maintainer account.
• The Miasma npm worm: 32 @redhat-cloud-services packages, then AsyncAPI, spread through binding.gyp and imports.
• The Mastra npm compromise: 140+ packages given an easy-day-js dependency that dropped a remote-access tool.
• The SAP CAP npm compromise: Mini Shai-Hulud’s first wave, through a stolen token and a hijacked workflow.
• The pgserve npm compromise: A postinstall stealer that republished itself with the victim’s stolen npm tokens.
• The @velora-dex/sdk npm compromise: Three prepended lines that installed a macOS backdoor on import.
• The Microsoft durabletask PyPI compromise: A stolen PyPI token and a dropper that ran on import.
• The laravel-lang tag rewrite: Every existing Composer tag re-pointed at a credential stealer.
• The onering crates.io compromise: A build.rs that sent each build’s latest commit and diff out.

For the whole year at once, 58 attacks from 2026 tested against Chainsaw gives the outcome for each one, including the 16 it does not stop.

New teardowns go out by email. Subscribe on the teardowns page.