Block malicious code with the most powerful open source policy engine
Enterprise-wide oss malware protection
Proactively detect and defend against open source malware across your software supply chain. Sonatype Repository Firewall is the only solution that enables you to block open source malware at the perimeter, before it enters your repository, and in your workflows.
Leveraging our powerful intelligence engine, Repository Firewall finds and blocks malware other solutions miss — including malware found in shadow downloads to protect your infrastructure from developers downloading components outside your repository.
+ 
Block malicious code at the edge
The power of Sonatype Repository Firewall just got better. You can now block open source malware and other malicious code at the edge with our new integration with Zscaler ZIA.
Detect and block malware at the network edge, in repositories, and across pipelines
Repository Firewall identifies and stops malicious components before they enter your SDLC no matter how they try to get in — whether a command line package request, Hugging Face model, or dependency added during a build.
Remove existing malicious code from repositories
Identify suspicious behavior using AI analysis
Unmatched malicious code prevention
Ensure your team is working with the best available open source. Sonatype Repository Firewall stops open source risks others can’t see with the industry's most comprehensive intelligence engine, powered by years of research and real-time behavioral analysis across millions of components.
With over 800,000 malicious packages detected across npm, PyPI, Maven, and other registries, our open source malware intelligence engine leads the industry in both scale and depth.
It’s not just what we block — it’s what we know that sets us apart.
Apply broad protection to networks and pipelines
Block known malicious components at the edge and during CI with repository integrations for full open source policy enforcement including compliance, quarantine, remediation, and audit visibility.
Set Open Source Policy Based on Risk Tolerance
Decide which components and AI models are allowed into your repository based on risk factors like age, popularity, and licensing credentials.
PROTECT AGAINST THE UNKNOWN
Set open source policy to intercept suspicious components, even before they are publicly disclosed as vulnerable.
CONFIGURE AUTOMATIC COMPLIANCE
Prevent applications from moving forward with unwanted or unapproved components and AI models.
Block downloads without impeding productivity
With our Zscaler ZIA plugin, developers stay protected from open source risks without needing to change how they work.
Integrate security into your CI/CD workflows
Automate security checks where you need them to identify open source malware using our standard API.
Eliminate remediation delays with proactive malware protection and clean inputs
By stopping issues before they enter development, teams avoid costly rework and accelerate release cycles.
“As open source vulnerabilities became increasingly problematic in recent years, particularly with Log4j, monitoring and enforcing software composition took on a greater sense of urgency. USPTO turned to Repository Firewall for the ability to block malicious packages from the start.”
Run products anywhere
Cloud
Self-Hosted
Air-Gapped
Intercept malicious open source at the door.
You are here
Universal repository support
Sonatype Nexus Repository Pro
Better together: Protect your Sonatype Nexus Repository (Pro) with Firewall.
JFrog Artifactory
Using Artifactory? No problem.Sonatype Repository Firewall supports JFrog’s Artifactory.
Repository Firewall language support
C
C++
Go
Gosu
Java
PHP
Python
R
Ruby
Scala
Swift
Visual Basic
Repository Firewall package support
Maven
Hugging Face
npm
PyPi
Nuget
Yum
Go
Rubygems
Conan
Cargo
Gradle
Conda
Features
-
Comprehensive malware intelligence engine
-
Full policy enforcement at the repository (quarantine, compliance enforcement, and remediation)
-
Network-layer malware blocking via Zscaler ZIA plugin
-
Standalone API for custom workflows
-
Real-time open source policy enforcement for Docker containers
-
Malware protection and policy enforcement for Hugging Face models
-
Hosted repository protection from namespace confusion attacks
-
Suspicious component auto-quarantine
-
Automatic release from quarantine
-
Automated version replacement for dependencies
-
Detection and removal of existing malware from repositories