A dependency firewall is a security checkpoint that evaluates open source packages before installation, blocking malicious, suspicious, or policy-violating packages. Unlike post-install scans, it intervenes at the critical moment before installation scripts can execute and access credentials, source code, or environment variables. The post covers what a dependency firewall should check — known malware, typosquatting, dependency confusion, package age, installation-script behavior, maintainer account-takeover signals, and obfuscation — and where to enforce it: developer workstations, CI/CD pipelines, containers, and AI coding environments. It also addresses the emerging risk of AI agents autonomously installing packages and the 'slopsquatting' attack where attackers register package names hallucinated by AI models. Dependency firewalls are positioned as one layer within a broader software supply-chain security program, complementing SBOMs, lockfiles, vulnerability scanning, and secure build practices.
