Firewall Pro Blocking Logic

Firewall Pro evaluates every package request against Sonatype Research threat intelligence before the package is fetched from the upstream registry. Packages identified as malicious are blocked immediately.

How Firewall Pro Blocks Components

Firewall Pro automatically blocks components that Sonatype has identified as potentially malicious or unverified.

Blocked threat categories include the following:

• Credential harvesting
• Code injection
• Backdoors
• Typosquatting attacks

Firewall Pro also blocks components that are:

• Unknown to Sonatype's identity team
• Pending review by Sonatype
• Marked as suspicious based on signals that may indicate a potential threat

When a request reaches Firewall Pro, the component is evaluated before it is served.

• If the component is identified as potentially malicious, the request is blocked, and the repository manager receives a 403 Forbidden response. The package is not cached or served.

• If the component has been reviewed and determined to be safe, the request is passed through to the upstream registry and served normally.

• If the component has not yet been evaluated by Sonatype Research, the request is blocked until the review is complete.

Firewall Pro uses a default-deny approach. Newly published packages may be temporarily unavailable while Sonatype Research evaluates them. This behavior helps prevent unverified components from entering your build pipeline.

Components remain blocked while they are unknown, pending review, or marked as suspicious and requiring additional investigation.

Dependency Range Filtering

When an npm or PyPI dependency uses a version range, Firewall Pro filters package metadata before returning it to your package manager. Your package manager resolves the range using only versions that Sonatype Research has reviewed and approved as safe. Potentially malicious and unverified versions are removed before dependency resolution happens, so your package manager selects a safe version from the start instead of failing after download.

For npm, if the original latest tag points to a removed version, Firewall Pro updates it to the highest remaining safe version. Your package manager then resolves the version range using only the filtered metadata.

Similarly, for PyPI, your package manager resolves the version specifier using only the filtered index.

If all versions in the specified range are removed, dependency resolution fails because no valid versions remain. Firewall Pro does not serve versions outside the requested range.

What Developers See When a Package is Blocked

When Firewall Pro blocks a package, your repository manager receives a 403 Forbidden response. The developer or CI pipeline sees a dependency resolution failure from the repository manager, not a direct error message from Firewall Pro.