A repository firewall is a policy control placed in front of a package registry or artifact repository. It screens incoming packages against security rules and can block, quarantine, or rewrite access to risky content before builders or CI systems fetch it. In practice, it acts as an intake gate for dependencies.
This matters because many supply chain attacks begin with a malicious or unsafe package entering the build path. A firewall can stop typosquatting, dependency confusion, known vulnerable versions, or packages from untrusted publishers before they are downloaded and installed. Defenders use it to enforce allowlists, vulnerability thresholds, signature checks, and internal curation policies. Unlike a scanner that only reports problems after a build, a repository firewall reduces exposure by preventing risky packages from ever reaching the pipeline.