Flat block

A flat block is the default behavior: any package your policy marks as Block is refused at download, every time, for every client. Nothing extra is configured on the firewall. Out of the box, known malware is already set to Block.

Before you start: a running firewall (Block installs with Firewall) and a client pointed at it (Configure registry: dev).

1. Install a known-bad package

lodahs is a security-holding package on npm. It is flagged as malware and contains no executable code, so it is safe to request.

npm cache clean --force
npm install lodahs

Expected output

The install fails:

npm notice Access denied: Your download has been blocked by the Socket Security Policy. Reason: Known malware ... Please contact your Security Team. Request ID: 073cad2918114ca0279c1b096bf38dac
npm error code E403
npm error 403 403 Forbidden - GET https://sfw.example.com/npm/lodahs/-/lodahs-0.0.1-security.tgz - Blocked by Security Policy

2. See where the block happens

The block lands on the tarball download, not the metadata request. This matters when you read logs: metadata traffic always looks allowed.

# Metadata: 200
curl -ksi https://sfw.example.com/npm/lodahs | head -1

# Tarball: 403
curl -ksi https://sfw.example.com/npm/lodahs/-/lodahs-0.0.1-security.tgz \
  | grep -iE '^HTTP|^x-socket|^npm-notice'

HTTP/2 200

HTTP/2 403
x-socket-decision: blocked
x-socket-block-reason: Known malware
x-socket-request-id: 1be5f0049abed5ddf81144598db01fc2
npm-notice: Access denied: Your download has been blocked by the Socket Security Policy...

3. (Optional) Prove transitive blocking

Real attacks usually arrive as a dependency of a dependency. The firewall checks every download the same way, so a malicious package deep in the tree is blocked just like a direct one. No public package depends on lodahs, so build a two-level tree locally:

mkdir -p /tmp/sfw-transitive/vendor-lib && cd /tmp/sfw-transitive

cat > vendor-lib/package.json <<'J'
{"name":"vendor-lib","version":"1.0.0","dependencies":{"lodahs":"0.0.1-security"}}
J
cat > package.json <<'J'
{"name":"poc-app","version":"1.0.0","dependencies":{"vendor-lib":"file:./vendor-lib"}}
J

grep -c lodahs package.json || true   # 0: the app never names it
npm install --no-audit --no-fund --ignore-scripts

The install fails with E403 naming lodahs, the package the app never asked for.

Verify

npm install lodahs fails with E403
Metadata returns 200, tarball returns 403
The 403 carries x-socket-decision: blocked, a block reason, and a request ID
A clean package (npm install lodash) still installs

Notes

PyPI: there is no stable malicious test package on PyPI because PyPI removes them quickly. Pick a currently flagged package from the Socket Threat Feed if you need a PyPI demo.
Repeat runs: verdicts are cached for cache.ttl (600 s by default). A repeat request inside that window serves the cached decision.
Custom block message: from firewall 2.8.0, socket.block_contact_message replaces "Please contact your Security Team." with your own text, such as a Slack channel or ticket queue.
Changing what blocks: see Policy config.