Veracode Package Firewall: Why & How to Use

Why use Veracode Package Firewall?


  • Block threats before they land in your codebase. Intercept risky packages at install time—malware, typosquats, dependency confusion, license issues, and more.
  • Enforce organization-wide policies consistently. Start with common controls and tailor rules to your risk profile; apply them across teams and projects.
  • Works where you work. Support for major ecosystems (e.g., npm, PyPI, Maven, NuGet, Go modules, RubyGems, Cargo) and proxy/repo setups.
  • Reduce friction, not velocity. Run in warn/audit mode first, provide clear feedback to developers, and streamline exceptions when business-critical.
  • Gain visibility and auditability. Logging, notifications, and review workflows help Security & Compliance track decisions and outcomes.


 

What does this unlock for me & my team?


  • Proactive supply-chain defense. Gate unsafe components before they enter repos or pipelines, reducing downstream risk.
  • Developer-friendly governance. Real-time, actionable guidance in the install path; fast, trackable exceptions when needed.
  • Cleaner SCA/ASPM signals later. Fewer surprise findings post-merge—less rework and fewer emergency patches.
  • Policy coverage on day one. Toggle common safeguards (malware indicators, suspicious publishing patterns, license constraints, package age, etc.).
  • One control plane, many ecosystems. Apply consistent rules across multiple languages and repositories to standardize practices.