What is a dependency firewall?

What it is

Aikido's explainer on the "dependency firewall" pattern, going beyond the concept to name the specific attacks it defends against and the concrete checks a firewall should perform. It is vendor content (Aikido Intel is their feed), but it carries actionable detail: which checks to require, and a native package-manager control you can adopt without buying anything.

How it works

A dependency firewall is an install-time checkpoint that inspects every package — including transitive dependencies, where most attacks hide — before download/install, regardless of whether a human, CI, or an AI agent triggered it. The page enumerates the checks a firewall "worth using" covers:

• Known malware — cross-reference against a live threat feed; the feed must move faster than the attacker (a package flagged 3 days late has already run).
• Minimum package age — block/delay versions published in the last 24–48h, since most malicious releases are pulled within a day or two.
• Dependency confusion, typosquats, unclaimed names — including "slopsquatting," where attackers register package names that AI agents hallucinate or that appear in docs/READMEs but were never published.
• Install-script behavior — static rules or sandboxed execution inspecting what postinstall hooks connect to, read, and spawn.
• Maintainer / account-takeover signals — e.g., an unexpected new maintainer.

Why it matters

Concrete incidents the page cites:

• axios (March 2026): hijacked maintainer account pushed malicious versions (~100M weekly downloads); payload arrived via a new transitive dependency plain-crypto-js, whose postinstall hook dropped a cross-platform RAT. The package existed under 24 hours before being pulled in.
• debug/chalk compromise: 18 packages, >2 billion combined weekly downloads, in one wave.
• Postmark-impersonating MCP server (Sept 2025): first confirmed malicious MCP server on npm; BCC'd every outgoing email to an attacker address.

Aikido Intel now analyzes up to 100,000 malicious packages/day (up from ~20,000 a year ago); in Q2 2026 it flagged 19,500 malicious out of ~7.5M package versions.

What to do

The most immediately actionable item requires no vendor product: every major npm-ecosystem package manager now ships a minimum release age setting that refuses to install any version newer than a configurable threshold. The page names pnpm, Yarn, Bun, and npm itself. Set this (24–48h per the page's reasoning) to close the early-detection window. The page gives no exact config keys/commands.

Caveats

Vendor post; "the specific checks vary between tools" and sandboxed install-script inspection is attributed to "more capable firewalls" only. The download/attack metrics are Aikido's own figures. No commands or version-specific config are provided — you'll need each package manager's docs to actually set minimum release age.