After LiteLLM's backdoor, we open-sourced an OS-level package firewall

Strix released an open-source, Apache 2.0-licensed OS-level package firewall that blocks known-malicious packages system-wide before installation, following the LiteLLM backdoor incident. The tool screens downloads on-device against Strix's malicious-package blocklist plus OSSF and OSV data, holds back new package versions for a default 24 hours (configurable via min_age_hours), and covers npm, PyPI, crates.io, the Go module proxy and RubyGems. Machine-wide installs are available for macOS 13+ on Apple silicon or T2 chips and Windows 10/11 x86-64 with TPM 2.0, while Linux machine-wide support is listed as coming soon and command-prefix mode works across platforms.

Stops malicious packages before they install. Built by Strix https://strix.ai : read the blogpost https://www.strix.ai/blog/firewall-announcement . Screening runs on your device: downloads go straight to the registry, never through a Strix server. Each package's name and version are looked up Strix's malicious-package blocklist https://github.com/usestrix/firewall-blocklist , so installs are blocked system-wide before reaching your machine. Machine-wide , from the latest release https://github.com/usestrix/firewall/releases/latest : - macOS: open Firewall.pkg , then approve the extension when macOS asks. - Windows: run the .msi as an admin. Prefix-mode cargo: cargo install strix-firewall curl: curl -LsSf https://github.com/usestrix/firewall/releases/latest/download/strix-firewall-installer.sh | sh Powershell: powershell -c "irm https://github.com/usestrix/firewall/releases/latest/download/strix-firewall-installer.ps1 | iex" | | Machine-wide | Command prefix | |---|---|---| | macOS 13+ | ✅ Apple silicon or T2 chip | ✅ | | Windows 10/11, x86-64 | ✅ with a TPM 2.0 | ✅ | | Linux glibc 2.35+ , x86-64 or arm64 | 🚧 Coming Soon | ✅ | | Registry | Package managers | |---|---| | npm | npm, pnpm, bun | | PyPI | pip, uv, pdm, pipenv | | crates.io | cargo | | Go module proxy | go | | RubyGems | gem | Mirrors of these, such as Artifactory or Nexus, can be added in via a config file. - Up-to-the-minute data: Strix constantly monitors updates to top packages covering 99% of installed packages to scan for malware, and publishes the results. We also consult OSSF's blocklist https://github.com/ossf/malicious-packages and OSV https://github.com/usestrix/firewall/blob/main/osv.dev , as well as other public reports. Updates take effect without any user action. - Holds back new versions. New packages are blocked by default, since malware is usually detected within a day. Although this can be disabled, configured, and bypassed . - Alerts you. On macOS and Windows a popup names the blocked package and links its advisory. - Two modes: - Machine-wide: screens downloads from every app, across your entire machine. - Command prefix: e.g., firewall npm install left-pad , or create an alias with alias npm='firewall npm . Settings are in a config.json : - Machine-wide: /Library/Application Support/Firewall/ on macOS, %ProgramData%\Strix Firewall\ on Windows. Only an admin can edit it; restart from the menu bar or tray to apply. - Command prefix: ~/.config/firewall/ on Linux, ~/Library/Application Support/com.usestrix.firewall/ on macOS, %APPDATA%\usestrix\firewall\config\ on Windows. { "min age hours": 48, "allow": { "npm": { "name": "left-pad", "version": "1.3.0" } }, "registries": { "npm": "https://npm.example.com/" , "pypi": "https://pypi.example.com/" }, "telemetry": false } | Key | Default | | |---|---|---| | min age hours | 24 | How long new versions are held back. 0 turns this off. | | allow | none | Packages exempt from the hold, by ecosystem npm , pypi , cargo , gem , go . Omit version for every version. Known malware is still blocked. | | registries | none | Mirrors, by the registry they copy npm , pypi , gem , go , cargo/index . Both modes screen every mirror listed; command-prefix mode also downloads from the first one. | | fail open | true | Allow a package when it can't be checked. | | telemetry | true | Log anonymized usage events to Strix. | | port | 8080 | Local port for command-prefix mode. | Apache 2.0. See LICENSE https://github.com/usestrix/firewall/blob/main/LICENSE .