The Firewall Your Developers
Will Actually Use.

Fuzzy string matching against a database of popular packages using normalized names and phonetic similarity. Catches requests vs request, numpy vs numyp, lodash vs 1odash, and thousands of documented campaign variants. Threshold configurable per firewall.

New package versions are held in quarantine for a configurable window (1–30 days) before your team can install them. This neutralizes zero-day campaigns that publish malicious packages and rely on fast installation before detection catches up. The most effective control for novel threats.

Mass simultaneous publishing of packages is a signature of organized attack campaigns — Lazarus Group, the s1ngularity campaign, and others have used coordinated bursts to overwhelm manual review queues. Hextrap detects abnormal publishing velocity as a standalone risk signal.

Packages that run code at install time (setup.py postinstall, npm preinstall scripts) are flagged and analyzed. Outbound network connections, file system access, and shell invocations from install scripts are high-confidence indicators of malicious intent.

Base64-encoded payloads, heavily nested eval() chains, and other obfuscation techniques are common in supply chain malware designed to evade signature-based scanners. Hextrap detects structural obfuscation as a risk signal independent of known signatures.

Attacks where a malicious public package is published with the same name as an internal private package, causing package managers to pull the malicious version. Hextrap's allow/deny list controls let you explicitly protect your private namespace from public shadowing.