A package firewall and an SCA scanner are not the same product. One sits on the install path: npm, pip, or Maven asks a proxy or a registry remote, and a denied package never reaches disk. The other scans after the install. Typosquats and maintainer-account takeovers hit in that gap, before the scanner has a file to read. Startups shopping for dependency proxies are buying that install-path control, not another report that lands after npm install already ran.
September 2025 showed what fits through that gap. CISA described a worm in the npm ecosystem, publicly known as Shai-Hulud, that compromised over 500 packages. GitHub said the wave was driven by account takeovers, and it removed or blocked more than 500 compromised packages from the registry. It kept going. A second wave in November 2025 reached about 25,000 repositories, and a 2026 variant, ChainDrop, hit more than 1,300 package versions with a combined 2 billion monthly downloads. A scanner that runs after install cannot unwind a postinstall script that already executed. We check these tools against first-party product pages on How we review tools.
A cooldown only delays a new version. A hard block stops known malware. A remote cache in Artifactory still needs a firewall on the path. On the call, ask whether a denied package returns an error to npm or pip so the install fails closed, or whether the scanner opens a ticket after the bits already landed.
Package Firewalls at a Glance
| Tool | Best for | Pricing model | Standout |
|---|---|---|---|
| Socket | Install-time proxy when you want behavioral malware blocking | Public seats. Firewall sold separately | CLI wrapper or HTTP proxy. Blocks before the bits land |
| Endor Labs | Malware plus CVE, license, and age policy at pull | Quote | 403 on known malware. Direct, Artifactory, Nexus, or GAR |
| Sonatype | Quarantine at the Nexus edge, or Firewall Pro off Nexus | Quote | Repository Firewall quarantines. Pro is allow or block |
| JFrog Curation | Request-time gate on Artifactory remotes | Quote | Catalog check, then a compliant version when policy allows |
| Veracode Package Firewall (Phylum) | A multi-ecosystem proxy in front of registries you already run | Quote | OPA policies. Artifactory, Nexus, Azure Artifacts, or direct |
| Bytesafe | A standalone firewall in front of any registry | Published monthly start | No registry migration. Maturity delay plus malware and license |
| Cloudsmith | A cloud registry used as the upstream proxy and policy plane | Public registry plans | Proxy and cache on public plans. Policy depth sits higher up |
How we evaluated dependency proxies
We used five checks on vendor product and pricing pages: whether the product can fail an install (not only report after the fact), which ecosystems that page claims, whether it plugs into an existing registry or sits as a proxy in front of one, how far policy goes past malware (CVE, license, age), and whether any price is public or the page is quote-only.
The tools below split on where they sit: a proxy you point package managers at, a gate on the registry you already run, or a cloud registry that proxies upstreams and then applies policy. Match that seat to the registry you actually have.
Socket
Socket Firewall intercepts package manager installs and evaluates each package before it reaches the machine. It covers developer laptops, CI, and production builds, with allow, warn, or block from organization policy. You can run it as a CLI wrapper, as a proxy, or at the network. The free Firewall path is local, with npm, Python, and Rust. Enterprise adds proxy deployment, centralized telemetry, and broader ecosystem coverage.
You are buying behavioral malware blocking on the install path, not a CVE scanner that runs after the lockfile is already dirty. Reachability and SBOM live on other Socket products. Firewall is sold on its own, and the plan price varies per product, so a Team or Business seat is not automatically the firewall.
Best for: Teams that want install-time malware blocking without replacing the registry they already have.
Key features:
- Install-time intercept with allow, warn, or block
- CLI wrapper, proxy, or network deployment
- Free local coverage for npm, Python, and Rust, with Enterprise proxy and extra ecosystems
Why we like it: Socket's page runs a timeline: package published, suspicious behavior flagged, execution blocked six minutes later.
Limits:
- Firewall is a separate product. Seat prices on the pricing page are not a Firewall quote
- Free Firewall is local-only. Proxy and org policy sit on Enterprise
- Ecosystem coverage on Firewall depends on the plan. Confirm it on the call
Price: Free is $0 per developer per month. Team is $25 per developer per month, minimum five developers. Business is $50 per developer per month, minimum 20. Yearly billing is up to 20% off. Enterprise is custom. Socket products are purchased individually and the plan price varies per product, so confirm the Firewall figure on the quote.
Endor Labs
Endor Labs Package Firewall sits between package manager clients (and private registries) and public registries. Known malware is blocked by default. The client gets a 403, and the package never touches disk. Clean packages pass through. You can hang it off JFrog Artifactory, Sonatype Nexus Repository, or Google Artifact Registry, or push config to laptops and CI when you do not have a registry. Policies cover malware, known vulnerabilities, restricted licenses, and minimum package age, with block, warn, or (on npm and PyPI, for malware and age) allow-safe-versions.
This is a policy engine on the pull path, not only a malware feed. Supported public registries are npm (npm, pnpm, Yarn, Bun), PyPI (pip, Poetry, uv), Go modules, and Maven. Google Artifact Registry cannot use a custom upstream for Go, so Go has to go through Artifactory, Nexus, or direct integration. VS Code extensions are a separate MDM path. Package Firewall is not the free developer AURI tier.
Best for: Teams that want malware, CVE, license, and age policy at pull, including shops that already run Artifactory or Nexus.
Key features:
- Default-block known malware with a 403 before download
- Policy for vulnerabilities, restricted licenses, and minimum package age
- Direct integration plus Artifactory, Nexus, and Google Artifact Registry
Why we like it: Malware is the default block. CVE, license, and age are policy you configure, with a curate path on npm and PyPI.
Limits:
- Quote only. This is not the free developer AURI product
- Allow-safe-versions is documented for malware and age on npm and PyPI, not every ecosystem
- Google Artifact Registry does not route Go modules through the firewall
- Endor's docs list Nexus as supported while the product-page FAQ still calls it coming soon. Confirm on the call
Price: Quote. Contact Endor Labs for Package Firewall. There is no public list rate.
Sonatype
Sonatype Repository Firewall is the Nexus-native product: policy at download, quarantine for suspicious components, automatic release when a component is confirmed safe, and waivers for governance. Firewall Pro is the SaaS gateway for shops that are not moving onto Nexus Repository. Pro supports npm, PyPI, NuGet, and Maven. A component is allowed or blocked. There is no quarantine state and no waiver workflow on Pro. Firewall Pro blocks on Sonatype Research verdicts and has no quarantine or waiver path, so confirm on the call what happens to a package Research has not classified yet.
Repository Firewall enforces at the registry edge. It does not help with a package a repo already vendor-copied. If Nexus is already the proxy, Repository Firewall is the product that can hold a component. If you are on another repository manager, Pro is the lighter allow-or-block path. Both are quote. Compare Plans is the path. Those animated malware counters are not a price.
Best for: Nexus shops that want quarantine at the proxy, or non-Nexus shops that will take allow-or-block without a review queue.
Key features:
- Repository Firewall: quarantine, policy, waivers, and automatic release on Nexus
- Firewall Pro: SaaS allow-or-block for npm, PyPI, NuGet, and Maven
- Hugging Face and container checks on Repository Firewall
Why we like it: Quarantine and waivers are Nexus-only. Pro is the gateway if you will not move repository managers.
Limits:
- Firewall Pro has no quarantine and no waivers. Confirm on the call what happens to a package Research has not classified yet
- Pro covers four ecosystems. Repository Firewall lists a wider set on Nexus
- No public list rate. Compare Plans is a quote path
Price: Quote. Use Compare Plans. There is no public list rate.
JFrog Curation
JFrog Curation is the request-time gate on Artifactory remotes. A developer, CI job, or agent asks Artifactory for a package. Curation checks the JFrog Catalog against your rules on maliciousness, severity, license, and age, and blocks or serves a compliant version. A 14-day immaturity hold is the example for new versions. Compliant Version Selection can swap in the highest version that still passes policy so the build keeps moving. Package Traffic Controller is the catch for clients that try to skip Artifactory and hit the public registry directly.
This control lives on Artifactory. It is not a standalone proxy you drop in front of some other registry. Cached packages are not gated unless you turn on enforce-on-cache. Waivers exist, they can expire, and the audit log is the receipt. Hugging Face models and IDE extensions are in scope. The CTA is a trial. There is no public list rate.
Best for: Artifactory shops that want the remote itself to refuse risky packages, including AI model and extension pulls.
Key features:
- Request-time Catalog check on Artifactory remotes
- Immaturity, license, and severity policy, with Compliant Version Selection
- Package Traffic Controller, optional enforce-on-cache, and Hugging Face coverage
Why we like it: The gate is the request, and a cache is not protected until you enable enforce-on-cache.
Limits:
- This is an Artifactory control. It is the wrong buy if you do not run Artifactory
- Cached packages stay available unless you enable enforce-on-cache
- Compliant Version Selection can hide the block from the developer. Confirm that is the behavior you want
- Package Traffic Controller only works through Zscaler, Cloudflare Gateway, or Netskope
Price: Curation is not on Pro. The floor is Enterprise X at $950/month plus the Curation add-on. A trial is available. Confirm the add-on on the quote.
Veracode Package Firewall (Phylum)
Veracode Package Firewall (Phylum) is a proxy in front of public registries, or a remote that Artifactory, Nexus, or Azure Artifacts can point at. Package managers can also talk to it directly. Supported ecosystems include npm, PyPI, Maven, NuGet, Go, RubyGems, and Cargo. Azure Artifacts is npm-only because of that product's upstream limits. Policies start from defaults. Custom rules use Open Policy Agent and Rego. If a package has not already been preprocessed, analysis takes about 30 minutes.
This is the classic multi-ecosystem firewall proxy, now under the Veracode brand. It is still quote. Ask whether your Artifactory remotes will use the Veracode registry URL, and what happens to a CI job during that 30-minute window on a brand-new package.
Best for: Teams that want one proxy policy across several ecosystems, including shops already on Artifactory or Nexus.
Key features:
- Proxy in front of public registries or as an Artifactory, Nexus, or Azure Artifacts remote
- npm, PyPI, Maven, NuGet, Go, RubyGems, and Cargo
- Default policies plus custom OPA/Rego rules
Why we like it: Point the registry remote or the package manager at the firewall and policy runs before the download.
Limits:
- Quote only. No public list rate
- Unprocessed packages can take about 30 minutes
- Azure Artifacts integration is npm-only
- Does not support EU-region or US Federal accounts
Price: Quote. Contact Veracode. There is no public list rate on the package firewall page.
Bytesafe
Bytesafe is a standalone dependency firewall you put in front of the registry you already have. It protects developers, CI, and AI agents. Point npm, Maven, pip, or the rest at Bytesafe. Upstream stays where it is. Cloud covers npm, Maven, PyPI, NuGet, Go, Composer, and Conda. Container images are an add-on. Policy includes malware and vulnerability blocking, a maturity delay on new versions, license rules, and dependency-confusion prevention.
It sits in front of the registry you already run, so you skip an Artifactory or Nexus migration. Cloud is EU-hosted SaaS. Enterprise adds on-prem, BYO cloud, and contract terms. There is a 14-day trial and no permanently free tier. The €99 Cloud product is the next-gen firewall in early access; the current firewall is closed to new customers. Early-access is 50% off the base fee for 3 months, plus a one-time €100 usage credit. Verify on the pricing page the day you buy.
Best for: Startups that want a firewall in front of whatever registry they already use, with a printed monthly start.
Key features:
- Sits in front of existing registries. No migration of the upstream
- Malware, vulnerability, license, maturity delay, and confusion controls
- npm, Maven, PyPI, NuGet, Go, Composer, Conda, with containers as an add-on
Why we like it: It prints a starting monthly price and still sits in front of the registry you already run.
Limits:
- No permanently free tier. Price follows the largest of users, packages scanned, or downloads
- SSO/OIDC, container firewall, and Deep Scan are paid add-ons on Cloud
- Composer and Conda are listed as beta on the pricing page
- The €99 product is next-gen early access; the current firewall is closed to new customers
Price: Cloud starts at €99 per month, priced on whichever is largest: active users, packages scanned, or downloads served. The starting allowance is 10 users, 5,000 packages, and 250,000 downloads. SSO/OIDC is €129 per month. Container image firewall is €99. Deep Scan is €99. Enterprise is custom. 14-day trial. Early-access is 50% off the base fee for 3 months, plus a one-time €100 usage credit. Verify on the pricing page.
Cloudsmith
Cloudsmith is a cloud artifact registry that can proxy and cache public upstreams, then apply policy on what is allowed to be pulled. That is a different seat from a proxy you drop in front of Nexus. You are moving (or starting) the registry in Cloudsmith. Public pricing is the registry plans: Core and Pro print. Ultra and Enterprise quote.
Policy depth is not on Core. Policy management is an Ultra and Enterprise capability. Documented types are vulnerability, license, package deny, and policy-as-code, and malware enforcement runs through policy-as-code on OPA/Rego. Cooldown (hide new versions until they reach a minimum age) is that same policy-as-code path. If upstream age metadata is missing, cooldown does not hide the package. Do not treat Core as the firewall.
Best for: Teams that want the registry itself to be the upstream proxy and are willing to buy the plan that actually enforces policy.
Key features:
- Upstream proxy and cache inside a cloud registry
- Standard CVE, license, deny, and malware policies on Ultra and Enterprise
- Optional policy-as-code, including a cooldown that hides young versions from the index
Why we like it: Core and Pro are costed in public. The controls that actually block sit on Ultra and Enterprise.
Limits:
- Core and Pro are registry plans. Standard policy types are documented on Ultra and Enterprise
- Cooldown and policy-as-code are add-ons. Missing age metadata means cooldown does not apply
- You are buying a registry, not a shim in front of the one you already run
Price: Core is $0 per month. Pro is $149 per month. Ultra and Enterprise are custom. The homepage offers a free trial. Confirm on the quote which plan actually enforces the block.
Dependency proxy features compared
| Tool | Where it sits | What it can block | Registry fit |
|---|---|---|---|
| Socket | Install-time CLI or proxy | Behavioral malware, plus org policy | Keeps your current registry |
| Endor Labs | Proxy in front of public registries | Malware, CVE, license, age | Direct, Artifactory, Nexus, GAR |
| Sonatype | Nexus edge, or Pro as a SaaS gateway | Malware and policy. Pro is malware-focused allow or block | Nexus-native, or Pro off Nexus |
| JFrog Curation | Request-time gate on Artifactory remotes | Catalog, license, severity, age | Artifactory only |
| Veracode Package Firewall (Phylum) | Multi-ecosystem proxy | OPA/Rego policy, including malware and license | Direct, Artifactory, Nexus, Azure Artifacts |
| Bytesafe | Standalone firewall in front of any registry | Malware, vuln, license, maturity, confusion | In front of the registry you already have |
| Cloudsmith | Cloud registry as upstream proxy | CVE, license, deny, malware on higher plans | You run Cloudsmith as the registry |
How these dependency proxies deploy
| Tool | Deploy shape | What developers change | Fail closed |
|---|---|---|---|
| Socket | CLI, proxy, or network | Wrap installs, or point at the proxy | Block at install when policy says so |
| Endor Labs | Direct, MDM, or registry remote | Often nothing if the registry remote moves | 403 on blocked malware. Warn is optional |
| Sonatype | Nexus plugin, or Pro remote URLs | Keep talking to the repository manager | Quarantine on Firewall. 403 on Pro |
| JFrog Curation | Artifactory remotes plus traffic controller | Keep talking to Artifactory | Block at request. Cache needs its own toggle |
| Veracode Package Firewall (Phylum) | Firewall registry URL as the remote | Registry remote, or package manager config | Block on policy. New packages may wait on analysis |
| Bytesafe | Cloud SaaS, or Enterprise on-prem / BYO | Point package managers at Bytesafe | Block, or delay, per rule |
| Cloudsmith | Cloudsmith as the registry | Point installs at Cloudsmith | Quarantine/403 on plans that run policy. Cooldown can skip missing age |
Strategic Decision Framework
Four questions to ask before you buy. Stay inside this shortlist. If a demo cannot answer these, keep walking.
| Critical question | Why it matters | What to evaluate | Red flag |
|---|---|---|---|
| Does a blocked package fail the install, or only warn after it lands? | Typosquats and account takeovers execute at install time. A ticket after the fact is SCA. | Watch npm or pip hit a denied version. You want an error, not a dashboard row. | The demo only shows a report on a repo that already installed the package. |
| Do you already run Artifactory or Nexus, or do you need a proxy in front of any registry? | A registry-native gate will not attach to a registry you do not have. | Name the registry on the call. Ask whether remotes change, or laptops do. | The pitch assumes you will migrate the registry in the same quarter as the firewall. |
| Is a cooldown enough, or do you need a hard block on malware, CVE, and license? | A 14-day hold is not a malware verdict. Missing age metadata can skip the hold. | Ask what happens to a known-malicious version that is already 30 days old. | The only control on the quote is package age. |
| Are you still buying SCA-only, and calling it a firewall? | Scan-after-install does not stop the first pull. You can need both. They are not substitutes. | If the product cannot sit on the download, it is not this category. | The salesperson maps every question back to a repo scan. |
What usually goes wrong when buying a dependency proxy
Most mismatches happen because a scanner, a cache, and a fail-closed firewall get treated as the same product.
| Problem | Solution |
|---|---|
| You buy SCA and call it a package firewall | Keep the split. The firewall has to be able to fail the install. SCA still has a job after install |
| You turn on a cooldown and think malware is handled | Ask for the hard block on known malware, and what happens when age metadata is missing |
| You already run Artifactory, so you assume the remotes are enough | A remote cache is not a firewall. You still need the request-time gate, including on packages already in cache |
Which dependency proxy should you pick
If you do not already run a registry, start with a proxy you can point npm and pip at: Socket when the job is behavioral malware at install time, Bytesafe when you want a standalone firewall with a printed monthly start. Endor Labs and Veracode Package Firewall (Phylum) also sit as proxies and can hang off Artifactory or Nexus later. If Artifactory is already the remote, start with JFrog Curation. If Nexus is the registry, start with Sonatype Repository Firewall. Firewall Pro is the allow-or-block gateway when you will not move onto Nexus. Cloudsmith is the buy when the registry itself is the control plane, and only on the plan that actually enforces policy. SCA still has a job after install. That is a different shortlist, covered in our software composition analysis tools guide.
