Skip to main content
Semgrep Malware Firewall is in private beta.

​
Overview

The Semgrep Malware Firewall prevents malicious packages from being installed on employee machines. It sits in front of package installs, checks each requested package against Semgrep’s continuously updated database of malware, and blocks anything that matches.

​
How it works

The firewall has the following parts:
  1. A lightweight client proxy that runs on every machine.
    • You set it up once with mfw install. It sets the standard proxy environment variables HTTP_PROXY and HTTPS_PROXY so package managers respect it automatically—no per-tool configuration is needed. For example, you don’t need to set up tool.uv.index manually for uv.
    • It watches traffic to known package registry URLs such as registry.npmjs.org, identifies package-download requests specifically—including tarballs, wheels, and similar artifacts—and gates those artifact requests on a response from the Semgrep backend before the download completes.
    • All other traffic is proxied through transparently.
  2. The Semgrep-operated malware firewall backend, which receives requests from the local proxy containing an ecosystem, package name, and version, and replies with a verdict.
  3. The malware database that is continuously updated from a variety of threat feeds and maintained by Semgrep’s Security Research team.
The request cycle:
  1. On install, the firewall runs mfw login to sign you in. Each verdict request is then authenticated with a short-lived bearer token.
  2. When you run a normal package install, the local proxy intercepts every package the installer tries to fetch.
  3. The proxy asks the Semgrep backend whether the specific version of that package is malicious.
  4. The backend matches the version to the malware database and returns a verdict.
  5. If the package is safe, the install proceeds normally. If it matches known malware, the proxy blocks the download and reports why.

​
Advisory and database sync objectives

  • For active, high-severity supply chain incidents, Semgrep’s security research team ships advisories as soon as an incident is identified, rather than waiting for it to be published to sources that are used otherwise, like the Open Source Vulnerabilities (OSV) database.
  • For all other findings, the malware database syncs from OSV every 2 hours.

​
Reporting

Semgrep AppSec Platform shows firewall reporting, including scanned and blocked dependencies, in the Malware firewall section of the Dashboard.

​
Supported languages

The firewall blocks malware when code is being developed written in JavaScript, Python, Go, Java, and Rust.

​
Cooldowns

The firewall doesn’t currently support configuring a cooldown period before a newly published package version can be installed. Semgrep recommends configuring cooldowns directly via your package managers. See cooldowns.dev for a guide across ecosystems.

​
Prerequisites for install

  • An active Semgrep account
  • Enable Semgrep Guardian
  • Access to a macOS or Linux terminal or shell

​
Install and verify

Install the firewall with the Semgrep Guardian skill or manually via the install command. The quickest path is via Semgrep Guardian, the /install-mfw skill installs and configures everything automatically.
Semgrep Guardian ships with an /install-mfw skill that installs and sets up the firewall for you.
1
In your AI coding agent with the Semgrep Guardian plugin installed (such as Claude Code), run:
2
Follow the prompts. The skill downloads the mfw client, adds a local certificate authority to your trust store, sets up shell integration and a background daemon, and walks you through signing in.
3
Restart your Terminal / shell so the proxy environment variables take effect.
Verify the install:
You should see:

​
Test the firewall

Use a known-safe demo package to confirm that the firewall blocks malicious installs without touching real malware.
1
Open or create a test directory and initialize a project:
2
Attempt to install the demo malware package:
3
Expected result: the install is blocked. The firewall should intercept and reject the package.
4
To test with a second package manager, repeat with pip:
Both these packages should be blocked by the Semgrep Malware Firewall. If either install succeeds, the firewall isn’t intercepting traffic correctly. Review the mfw doctor output, and see Troubleshoot mfw doctor failures.

​
Determine whether a specific dependency version is malicious

The mfw api command can be used to determine if a specific version of a package is malicious:

​
Uninstall the firewall

To remove the firewall and its proxy configuration from a machine:
This clears the HTTP_PROXY and HTTPS_PROXY environment variables that mfw install configured and removes the local proxy process. Restart your terminal or shell afterward to confirm that the variables are cleared. To verify removal:
It should no longer report Semgrep mfw is protecting this machine ✅.

​
Troubleshoot mfw doctor failures