Enforce Device Protection During Package Installation

Block package installations on machines where Aikido Device Protection is not active. This lets you enforce protection as part of your development workflow, without relying on policy alone.

Why use this

Supply chain attacks often arrive through dependencies. Device Protection intercepts malicious packages at install time but only if it's running. Adding a pre-install check ensures developers cannot accidentally install packages on an unprotected machine.

How it works

Most package managers support lifecycle hooks or wrapper scripts that run before installation. If the check exits with a non-zero code, the install is aborted and the developer sees a clear message.

macOS

/Applications/Aikido\ Endpoint\ Protection.app/Contents/Resources/scripts/healthy

Windows

& "C:\Program Files\AikidoSecurity\EndpointProtection\scripts\Healthy.ps1"

Package manager examples

npm

Add a preinstall script to package.json:

{
  "scripts": {
    "preinstall": "/Applications/Aikido\ Endpoint\ Protection.app/Contents/Resources/scripts/healthy"
  }
}

yarn / pnpm

Both yarn and pnpm respect the preinstall script in package.json:

{
  "scripts": {
    "preinstall": "/Applications/Aikido\ Endpoint\ Protection.app/Contents/Resources/scripts/healthy"
  }
}

pip / uv

pip and uv have no native pre-install hook. Use a Makefile target that wraps the install:

install: check-aikido
	pip install -r requirements.txt

check-aikido:
	/Applications/Aikido\ Endpoint\ Protection.app/Contents/Resources/scripts/healthy

Run make install instead of pip install directly. The same pattern works for uv sync or poetry install.

Maven

Add the exec-maven-plugin to the validate phase in pom.xml. This runs before any dependencies are resolved:

<plugin>
  <groupId>org.codehaus.mojo</groupId>
  <artifactId>exec-maven-plugin</artifactId>
  <version>3.1.0</version>
  <executions>
    <execution>
      <id>check-aikido</id>
      <phase>validate</phase>
      <goals><goal>exec</goal></goals>
      <configuration>
        <executable>bash</executable>
        <arguments>
          <argument>-c</argument>
          <argument>/Applications/Aikido\ Endpoint\ Protection.app/Contents/Resources/scripts/healthy</argument>
        </arguments>
      </configuration>
    </execution>
  </executions>
</plugin>

NuGet

Add a .targets file to your project (e.g. CheckAikido.targets) and import it in your .csproj:

<!-- CheckAikido.targets -->
<Project>
  <Target Name="CheckAikido" BeforeTargets="Restore">
    <Exec Command="bash -c &quot;/Applications/Aikido\ Endpoint\ Protection.app/Contents/Resources/scripts/healthy&quot;" />
  </Target>
</Project>

<!-- YourProject.csproj -->
<Import Project="CheckAikido.targets" />

Git hooks

Git hooks fire before commits or checkouts, not package installs -- but they are a useful second line of enforcement for teams that want to block all git activity on unprotected machines.

Add the check to .git/hooks/pre-commit:

#!/bin/bash
/Applications/Aikido\ Endpoint\ Protection.app/Contents/Resources/scripts/healthy

Make it executable:

chmod +x .git/hooks/pre-commit

.git/hooks is not tracked by git. To share hooks with your team, use a tool like Lefthook or Husky to manage and commit hooks as part of your repository.