SafeDep Documentation

A malicious install script sends stolen data to a host that the attacker controls. A network policy lists the hosts that an install can reach. The PMG proxy checks each connection against the policy. Each built-in sandbox profile has a network policy. For example, the npm profile allows registry.npmjs.org, registry.yarnpkg.com, npm.pkg.github.com, and github.com on port 443, and denies every other destination. The policy has two modes:

audit (default): PMG records each destination that the policy denies, and lets the connection through.
enforce: PMG refuses each destination that the policy denies.

Network policy needs PMG v0.33.0 or later, and the sandbox turned on.

Build a policy from a run

Run the install in audit mode

pmg npm install

When the policy denies a destination, the report starts with Network policy would deny and names each destination. The report also shows the run ID and the command to propose a profile.

Propose a profile

pmg sandbox profile propose --last --new my-npm

PMG writes the user profile my-npm. It inherits the npm profile, allows each host that the run reached, and denies every other destination. Run the command without --new to see the proposal first.

Review the profile

pmg sandbox profile edit my-npm

Remove each host that the install does not need. PMG checks the profile when you close the editor.

Use the profile for npm

pmg config set sandbox.policies.npm.profile my-npm

Turn on enforce mode

pmg config set sandbox.network_mode enforce

The mode applies to every package manager. The built-in profiles of the other package managers also deny every host that they do not list.

Fix a refused destination

In enforce mode, the package manager gets an HTTP 403 error for a denied destination. The PMG report names the destination and the rule:

⊘ Network policy denied registry.example.com:443  rule *:*
  Allow it with pmg sandbox allow net-connect=registry.example.com:443.

To allow the destination for one run, use --sandbox-allow:

pmg --sandbox-allow net-connect=registry.example.com:443 npm install

To keep the allowance for this repository, use pmg sandbox allow:

pmg sandbox allow net-connect=registry.example.com:443

Refuse connections that skip the proxy

The policy applies to the connections that go through the PMG proxy. A script that ignores the proxy variables can connect directly. To refuse direct connections, set network_via_proxy_only: true in the profile. Landlock and Seatbelt support this setting. Bubblewrap refuses a profile with this setting. On a Linux host or a CI runner, kernel enforcement routes every process through the proxy.

With SafeDep Cloud

The network policy is free in PMG. With SafeDep Cloud, you see the destinations that the policy refused on every endpoint. PMG records each destination that the policy refuses, or in audit mode would refuse. This query lists them:

SELECT endpoints.identifier,
       package_guard_events.hostname,
       package_guard_events.timestamp
FROM package_guard_events
JOIN endpoints ON endpoints.id = package_guard_events.invocation_id
WHERE package_guard_events.event_type = 'PMG_EVENT_TYPE_NETWORK_POLICY_DECISION'
ORDER BY package_guard_events.timestamp DESC

Use the result to find a host that the policy must allow, or a package that tried to reach an unknown host.

This section needs the SafeDep Cloud Team or Enterprise plan, with PMG connected to your tenant. See pricing.

Next steps

For the rule syntax, IP literal rules, and how the proxy matches a host, see Network rules in the PMG repository.

Allow Only Known Hosts in GitHub Actions

Apply a network policy to a CI job.

Sandbox Your AI Coding Agent

Limit the hosts that a coding agent can reach.

CI/CD Package Blocking

Limit the Hosts a Package Install Can Reach

Build a policy from a run

Fix a refused destination

Refuse connections that skip the proxy

With SafeDep Cloud

Next steps

Allow Only Known Hosts in GitHub Actions

Sandbox Your AI Coding Agent

​Build a policy from a run

​Fix a refused destination

​Refuse connections that skip the proxy

​With SafeDep Cloud

​Next steps

Allow Only Known Hosts in GitHub Actions

Sandbox Your AI Coding Agent

Build a policy from a run

Fix a refused destination

Refuse connections that skip the proxy

With SafeDep Cloud

Next steps