Replit's Package Firewall Blocks 8,000 Malicious Installs Daily Before They Strike

Most security tools catch bad packages after they've already landed in your project. Replit's new Package Firewall flips that model entirely -- it intercepts malicious installs at the network level, before any code ever reaches your environment. Launched in partnership with supply-chain security firm Socket, the feature is already blocking around 8,000 malicious package installs per day across the platform.

The window nobody was watching

The standard playbook for dependency security goes something like this: scan your project before you publish, check your lock file, run npm audit. The problem is that all of those checks happen after installation. Replit already scans projects for vulnerable dependencies and audits dependencies before publishing -- but risk shows up earlier than that, the moment a malicious package gets installed.

Socket intercepts packages before they install, catching novel malware through behavioral analysis, while traditional tools like Snyk monitor installed dependencies after publish, alerting on newly-disclosed CVEs. That gap matters enormously for a specific class of threat: malware that does its damage the instant it runs -- stealing secrets, opening backdoors, or exfiltrating environment variables. By the time a publish-time scan flags it, the attack has already succeeded.

How it works

When you or the Replit Agent run an install command like npm install or pip install, the request passes through Package Firewall. If the package is clean, the install runs as usual. If Socket has flagged the package as malicious or compromised, the install is blocked before any code reaches your environment.

When something gets blocked, you get a clear message explaining what was stopped and why, with a link to Socket's findings for that package. Crucially, the Replit Agent sees the same signal -- so it can suggest a safe alternative or hand the decision back to you rather than silently failing or retrying with a different (potentially worse) package.

Package Firewall is now part of Replit Auto-Protect, the platform's default security layer that also includes a WAF firewall and SSL/TLS encryption. Since rolling out a week ago, Package Firewall has been blocking around 8,000 packages per day across builders on Replit.

The AI coding threat nobody planned for

The timing isn't coincidental. The packages getting blocked most often aren't obscure -- they're workhorses like form-data, protobufjs, handlebars, fast-xml-parser, and grpc-go. The flagged versions carry critical vulnerabilities spanning remote code execution, path traversal, and prototype pollution. And the overwhelming majority of these advisories were disclosed after the training cutoff of the models recommending them.

This creates three distinct attack vectors that are now endemic to AI-assisted development:

• Typosquats: A malicious package with a name one keystroke away from a real one -- reqeusts instead of requests. Classic, but still effective.
• Slopsquats: The practice of registering a non-existent software package name that an LLM may hallucinate in its output, whereby someone unknowingly may copy-paste and install the software package without realizing it is fake. Research found that 19.7% of LLM-recommended packages did not exist, with open-source models hallucinating far more frequently -- 21.7% on average, compared to proprietary models at 5.2%.
• Stale recommendations: A real package with a disclosed vulnerability that the AI recommends because it was known-good before its training cutoff. The model is confident; the package is compromised.

AI now writes more than 90% of code at top engineering organizations. A lot of what AI produces reaches for open source dependencies developers have never read. The volume of third-party code entering production keeps going up, while the time anyone spends reviewing it keeps going down.

Socket's moment

The Replit partnership lands just weeks after Socket raised a $60M Series C at a $1B valuation, led by Thrive Capital. The round included participation from Andreessen Horowitz, Abstract Ventures, and Capital One Ventures, bringing Socket's total funding to $125 million. The company has grown fast: since closing its Series B in October 2024, Socket has grown from 7,500 organizations to more than 27,000, protects 1.5 million repositories, secures over 11.6 million commits every month, and blocks more than 10,000 supply chain attacks every week.

Socket's platform works by analyzing the behavior of open source dependencies before they are introduced into a codebase, rather than relying solely on known vulnerability databases. The platform combines AI-assisted analysis with human verification, enabling security teams to detect malicious behavior and address dependency risk in real time -- including novel attacks that have yet to be publicly documented. "Socket does not just take the results of AI and give them directly to our customers," CEO Feross Aboukhadijeh said. "Everything that we do is vetted by humans."

The threat landscape Socket is defending against has been relentless. The Shai-Hulud worm has hit npm in repeated waves since September 2025. Attackers compromised Aqua Security's Trivy scanner in March and used the stolen credentials for follow-on attacks. DPRK-aligned attackers ran a social engineering campaign against Node.js maintainers, and the same playbook compromised Axios. Socket's automated malware detection flagged the malicious Axios dependency within six minutes of it being published.

Who wins, who needs to pay attention

For Replit users -- especially those building with the AI Agent -- this is a meaningful default-on protection that requires zero configuration. The Agent itself benefits directly: when it tries to install a flagged package, it gets a structured signal it can act on rather than a silent failure or a successful install of malware.

The broader implication is a shift in where security responsibility sits. Software supply chain attacks have become "the dominant force reshaping the global cyber threat landscape," with threat actors going after trusted vendors, open-source software, and managed service providers to gain inherited access to hundreds of downstream organizations. The supply chain threat can rapidly escalate a single localized intrusion into something with large-scale, cross-border impact.

For teams not on Replit, the takeaway is practical: npm audit only catches known vulnerabilities after they're documented. In 2026, the complete defense combines multiple layers -- but if you're choosing one to start with, Socket prevents the attacks that are hardest to recover from. Socket's CLI is available as a standalone tool for any development environment.

The software supply chain security platform market reached $12.29 billion in 2025 and is projected to grow at a 14.91% CAGR. With AI coding agents now autonomously running install commands millions of times a day, the install-time attack surface has become one of the most consequential -- and least defended -- vectors in modern software development. Replit and Socket are betting that the fix belongs in the infrastructure, not in the developer's hands.