After LiteLLM's backdoor, we open-sourced an OS-level package firewall

Strix Firewall is an open-source defense against malicious software packages, introduced in response to supply-chain attacks such as the LiteLLM backdoor. It checks package names and versions against Strix’s blocklist before downloads reach the machine; downloads go directly from the package registry rather than through Strix servers. Its data draws on continuous monitoring of popular packages, public reports, the OSSF blocklist, and OSV. The tool also holds new package versions for 24 hours by default, reflecting the risk that malicious releases may take time to be identified. Users can configure or disable that delay, but known malicious packages remain blocked.

Firewall supports npm, pnpm, and bun; pip, uv, pdm, and pipenv; Cargo; Go; and RubyGems, with registry mirrors configurable. It can screen downloads machine-wide on macOS 13+ and Windows 10/11, or run as a command prefix; machine-wide Linux support is listed as forthcoming. macOS and Windows display alerts naming blocked packages and linking to advisories. Configuration allows specific packages to bypass the age-based hold, sets mirrors, and controls options such as telemetry and what happens when a package cannot be checked; the default is to allow unchecked packages. The project is licensed under Apache 2.0.