Quickstart

This walks through npm. Every other ecosystem follows the same three steps; see its client page.

1. Sign in

vulnetix auth login
vulnetix auth status

npm needs the Package Firewall add-on, or the Enterprise plan, which includes it. The pkg.go.dev API (go-dev) and the AUR (aur) are free on every plan. See Billing.

2. Configure npm

Preview, then write:

vulnetix package-firewall npm --dry-run
vulnetix package-firewall npm

This writes ~/.netrc, ~/.npmrc and ~/.yarnrc.yml. Check it took:

npm config get registry
# https://packages.vulnetix.com/npm/
npm cache clean --force
npm install lodash

3. Set a policy

vulnetix config set package-firewall \
  --block-malware true \
  --block-kev true \
  --cvss-threshold 9.0 \
  --cooldown-days 7
vulnetix config get package-firewall

Changes reach the proxy within 60 seconds.

4. See a decision

Request a package directly and read the firewall headers:

AUTH=$(printf '%s:%s' "$VULNETIX_ORG_ID" "$VULNETIX_API_KEY" | base64 -w0)
curl -s -o /dev/null -D - -H "Authorization: Basic $AUTH" https://packages.vulnetix.com/npm/lodash | grep -i '^x-vulnetix'

An allowed request prints nothing here, or only X-Vulnetix-Firewall-Mode when the org is not in enforce mode. A blocked request carries X-Vulnetix-Firewall: blocked and a reason; see Block responses. Every decision is listed in the console at www.vulnetix.com/resolve/logs#package.

Next

• Policy settings
• Allow and deny lists, including namespace entries for packages you publish yourself
• Troubleshooting