The self-hosted package firewall
Yellow Jack does.
A gate you run on your own infrastructure for npm, PyPI, Maven and Docker. Every package fetched through it is checked against published malware advisories and your own policy before it reaches a laptop or a build — and your dependency list never leaves your network.
$ npm --registry http://localhost:8080 install is-number
added 1 package in 3s
$ npm --registry http://localhost:8080 install left-pad
npm error code E403
npm error 403 Forbidden - GET http://localhost:8080/left-pad
- blocked by firewall:
package "left-pad" is on this organisation's deny list;
refused without contacting upstream. This is a local
policy decision, not a published malware advisory ...The problem
Every npm install, pip install and docker pull runs code your organisation didn't write, on laptops and build servers that hold your credentials. To your network firewall it is ordinary HTTPS to a registry it already trusts.
In September 2025, an attacker who phished a single npm maintainer published malicious releases of chalk and debug — packages present in a vast share of JavaScript builds. Within weeks the Shai-Hulud worm was stealing publishing tokens and republishing itself across hundreds of npm packages.
A scanner reports that after the fact. By then, the code has already run.
How it works
npm, pip, Maven and Docker already know how to use a different registry. Yellow Jack runs as containers on your own infrastructure — nothing to install on a developer's machine.
Before a package reaches a laptop or a build, it is evaluated against advisories and your policy. Malware and deny-list decisions are made without contacting the registry at all.
Allowed package files pass through byte-for-byte. Refused ones fail in the developer's terminal with the reason, and every decision lands in the audit log.
The controls
Advisories
Every package is checked against published malware advisories — the OpenSSF Malicious Packages data, via OSV — held on your own server and consulted before any network call is made.
npm and PyPI in practice — public advisories barely cover Maven or Docker
Cooldown
A new version isn't admitted until it has been public for 14 days — or as long as you choose — which gives maintainers and advisory feeds time to catch a bad one. Resolvers settle on the last release that is old enough.
On by default for npm, PyPI and Maven
Your lists
Block a package by name or a single release; allow what your team has vetted. Keep the lists in git so every change has an author — the git-enabled console can edit them and commit for you.
All four ecosystems
Optional
Score the source repository behind a package with OpenSSF Scorecard, and route anything that can't be scored to a reviewer's queue instead of guessing.
Optional add-on
The console
See what the gate decided, for which machine, and why — and what each replica is actually enforcing, rather than what a config file says it should be.
| When | Package | Ecosystem | Verdict | Source | Reason |
|---|---|---|---|---|---|
| 2026-09-15 02:49:41 UTC | is-number | npm | allow | 172.20.0.1 | score 7.5 >= threshold 0.0 |
| 2026-09-15 02:48:58 UTC | left-pad | npm | block | 172.20.0.11 | package "left-pad" is on this organisation's deny list; refused without contacting upstream. This is a local policy decision, not a published malware advisory |
| 2026-09-15 02:47:43 UTC | left-pad | npm | block | 172.20.0.1 | package "left-pad" is on this organisation's deny list; refused without contacting upstream. This is a local policy decision, not a published malware advisory |
Policy 2b7743eca4bd3f4c — 1 replica · npm
A request matching no rule above is rejected.
Rebuilt from our reference deployment's console, 15 September 2026 — real labels and rows; some columns and reason text shortened to fit.
Security
A package firewall sits in the path of every dependency your teams pull. It should be the easiest part of that path to trust — so these are properties we test, not adjectives.
The gate decides locally. By default no inventory, no SBOM and no usage telemetry is sent to us — we never learn which packages you use.
npm checks every download against the registry's own integrity hash — so you can verify this one without trusting us.
A firewall in your supply chain shouldn't widen it. The gate binary links only Go's standard library, and our build fails if a third-party package gets in.
A request the gate can't recognise as a package fetch is blocked by default, not waved through to the registry.
Verdicts are deterministic — the same decision and the same reason, whether the gate is idle or under load.
The reason travels in the response the client receives and into the audit log, with what happens next and who decides it.
Yellow Jack helps you show the work. It doesn't make you compliant, and we won't tell you it does.
| Obligation | What it asks | What you can show |
|---|---|---|
| NIST SSDF (SP 800-218) PW.4.1, PW.4.4 | Acquire well-secured third-party components, and verify they meet your requirements | A policy decision on every component fetched through the gate, with its reason |
| EU Cyber Resilience Act, Art. 13(5) | Exercise due diligence when integrating third-party components | An exportable log of every package allowed or refused, and why |
| Incident response | "Did it get in — where, and when?" | Search decisions by package, ecosystem and verdict; see which machines pulled it |
Customer logos, analyst coverage and a SOC 2 report — and our source isn't public yet. So we won't ask you to take our word for anything on this page. We'll show you, on a gate running in front of you, with the engineers who built it.
Who's building it
Security software written by the people you'll talk to. We'll be sharing what we learn — including write-ups on real supply-chain attacks — on our blog.
AI Engineering
DevOps Engineering
We'll walk your security and platform leads through a live gate. Bring a few packages you depend on and see what it decides, and why.