DepWall — package verdicts

See the verdict DepWall's install-time gate would return for an npm or PyPI package. It reports; it does not block.

DepWall is an install-time firewall for AI coding agents. It sits in front of npm, pip, cargo, go and other package managers and decides whether a package is safe to pull — before any of its code runs. This extension is the browser half of that: it shows you the verdict the gate would return, at the moment you are deciding whether to add a dependency. • A verdict card on any npm or PyPI package page • The tier on the toolbar icon — letter as well as colour • Right-click any selected package name, install command, or package link • A popup that understands what you actually paste: express, @types/node@20.11.0, npm install -D @scope/x@1.2.3, requests==2.31.0 • Optional, per-site: underline "npm install …" lines in READMEs and answers, and show the verdict inline • A confidence meter on every detection, because "this tarball is byte-for-byte a known-malicious one" and "this package was published last week" are not the same claim and should not look the same The meter rates the evidence, not the package. It is not a probability that something is malicious and not a risk score — it says how directly the signals that fired observe what they claim, so you know whether a stop is worth ten seconds or ten minutes. It does not block anything. A browser extension has no position in the install path. The command-line tool is what enforces; this tells you what it would say. Only the ecosystem, package name and version ever leave your browser. Never the page, never your history. Free and open source (Apache-2.0).