{"slug": "after-litellm-s-backdoor-we-open-sourced-an-os-level-package-firewall", "title": "After LiteLLM's backdoor, we open-sourced an OS-level package firewall", "summary": "Strix released an open-source, Apache 2.0-licensed OS-level package firewall that blocks known-malicious packages system-wide before installation, following the LiteLLM backdoor incident. The tool screens downloads on-device against Strix's malicious-package blocklist plus OSSF and OSV data, holds back new package versions for a default 24 hours (configurable via min_age_hours), and covers npm, PyPI, crates.io, the Go module proxy and RubyGems. Machine-wide installs are available for macOS 13+ on Apple silicon or T2 chips and Windows 10/11 x86-64 with TPM 2.0, while Linux machine-wide support is listed as coming soon and command-prefix mode works across platforms.", "body_md": "Stops malicious packages before they install. Built by [Strix](https://strix.ai): read [the blogpost](https://www.strix.ai/blog/firewall-announcement).\n\nScreening runs on your device: downloads go straight to the registry, never through a Strix server.\nEach package's name and version are looked up [Strix's malicious-package blocklist](https://github.com/usestrix/firewall-blocklist), so installs are blocked system-wide *before* reaching your machine.\n\n**Machine-wide**, from the [latest release](https://github.com/usestrix/firewall/releases/latest):\n\n- macOS: open `Firewall.pkg` , then approve the extension when macOS asks.\n- Windows: run the `.msi` as an admin.\n\n**Prefix-mode**\n\ncargo:\n\n```\ncargo install strix-firewall\n```\n\ncurl:\n\n```\ncurl -LsSf https://github.com/usestrix/firewall/releases/latest/download/strix-firewall-installer.sh | sh\n```\n\nPowershell:\n\n```\npowershell -c \"irm https://github.com/usestrix/firewall/releases/latest/download/strix-firewall-installer.ps1 | iex\"\n```\n\n|  | Machine-wide | Command prefix | \n|---|---|---|\n| macOS 13+ | ✅ Apple silicon or T2 chip | ✅ | \n| Windows 10/11, x86-64 | ✅ with a TPM 2.0 | ✅ | \n| Linux (glibc 2.35+), x86-64 or arm64 | 🚧 Coming Soon | ✅ | \n\n| Registry | Package managers | \n|---|---|\n| npm | npm, pnpm, bun | \n| PyPI | pip, uv, pdm, pipenv | \n| crates.io | cargo | \n| Go module proxy | go | \n| RubyGems | gem | \n\nMirrors of these, such as Artifactory or Nexus, can be added in via a config file.\n\n- **Up-to-the-minute data:** Strix constantly monitors updates to top packages (covering 99% of installed packages) to scan for malware, and publishes the results. We also consult[OSSF's blocklist](https://github.com/ossf/malicious-packages) and[OSV](https://github.com/usestrix/firewall/blob/main/osv.dev) , as well as other public reports. Updates take effect without any user action.\n- **Holds back new versions.** New packages are blocked by default, since malware is usually detected within a day. (Although this can be disabled, configured, and bypassed).\n- **Alerts you.** On macOS and Windows a popup names the blocked package and links its advisory.\n- **Two modes:**  - **Machine-wide:** screens downloads from every app, across your entire machine.\n  - **Command prefix:** e.g.,`firewall npm install left-pad` , or create an alias with`alias npm='firewall npm` .\n\nSettings are in a `config.json`:\n\n- Machine-wide: `/Library/Application Support/Firewall/` on macOS,`%ProgramData%\\Strix Firewall\\` on Windows. Only an admin can edit it; restart from the menu bar or tray to apply.\n- Command prefix: `~/.config/firewall/` on Linux,`~/Library/Application Support/com.usestrix.firewall/` on macOS,`%APPDATA%\\usestrix\\firewall\\config\\` on Windows.\n\n```\n{\n  \"min_age_hours\": 48,\n  \"allow\": { \"npm\": [{ \"name\": \"left-pad\", \"version\": \"1.3.0\" }] },\n  \"registries\": {\n    \"npm\": [\"https://npm.example.com/\"],\n    \"pypi\": [\"https://pypi.example.com/\"]\n  },\n  \"telemetry\": false\n}\n```\n\n| Key | Default |  | \n|---|---|---|\n| `min_age_hours` | `24` | How long new versions are held back. `0` turns this off. | \n| `allow` | none | Packages exempt from the hold, by ecosystem ( `npm` ,`pypi` ,`cargo` ,`gem` ,`go` ). Omit`version` for every version. Known malware is still blocked. | \n| `registries` | none | Mirrors, by the registry they copy ( `npm` ,`pypi` ,`gem` ,`go` ,`cargo/index` ). Both modes screen every mirror listed; command-prefix mode also downloads from the first one. | \n| `fail_open` | `true` | Allow a package when it can't be checked. | \n| `telemetry` | `true` | Log anonymized usage events to Strix. | \n| `port` | `8080` | Local port for command-prefix mode. | \n\nApache 2.0. See [LICENSE](https://github.com/usestrix/firewall/blob/main/LICENSE).", "url": "https://wpnews.pro/news/after-litellm-s-backdoor-we-open-sourced-an-os-level-package-firewall", "canonical_source": "https://github.com/usestrix/firewall", "published_at": "2026-10-26 18:06:05+00:00", "updated_at": "2026-10-26 18:11:35.591646+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools", "ai-tools"], "entities": ["Strix", "LiteLLM", "npm", "PyPI", "crates.io", "RubyGems", "OSSF", "OSV"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/after-litellm-s-backdoor-we-open-sourced-an-os-level-package-firewall", "markdown": "https://wpnews.pro/news/after-litellm-s-backdoor-we-open-sourced-an-os-level-package-firewall.md", "text": "https://wpnews.pro/news/after-litellm-s-backdoor-we-open-sourced-an-os-level-package-firewall.txt", "jsonld": "https://wpnews.pro/news/after-litellm-s-backdoor-we-open-sourced-an-os-level-package-firewall.jsonld"}}