Phylum NuGet Registry

The Phylum NuGet registry is based on NuGet's Server API.

Configuration

All configuration options will require a Phylum API key, since Phylum requires authentication. You can find out how to generate one in our API Keys documentation.

In the following examples, all API keys will be represented as <PHYLUM_API_KEY>, so make sure to replace them with your generated key.

Additionally, if the default policy is not sufficient, a group can be passed to evaluate all packages against the group's policy. To do this, just replace <PHYLUM_ORG> and <PHYLUM_GROUP> with the desired org and group name. The supplied API key must have access to this group.

If Phylum's default policy is sufficient, you can omit the username from the authentication details.

dotnet

To use the Phylum NuGet registry, the original nuget.org registry first needs to be disabled:

dotnet nuget disable source nuget.org

Once the official registry is disabled, the Phylum source can be added. If you're not running Windows, you'll also have to add the --store-password-in-clear-text flag.

dotnet nuget add source https://nuget.phylum.io/v3/index.json \
    --protocol-version 3 \
    --name Phylum \
    --valid-authentication-types basic \
    --username <PHYLUM_ORG>/<PHYLUM_GROUP> \
    --password <PHYLUM_API_KEY>

⚠️ WARNING ⚠️

Do not accidentally save your token into your shell history.

A blocked package will show up in dotnet output as missing:

/Demo.csproj : error NU1102: Unable to find package Example.Vulnerable with version (= 1.2.3)
/Demo.csproj : error NU1102:   - Found 42 version(s) in Phylum [ Nearest version: 2.0.0 ]

If all versions of a package are blocked, it will be explicitly pointed out as having failed analysis:

error: NU1301: Failed to retrieve information about 'Example.Vulnerable' from remote source 'https://nuget.phylum.io/v3-flatcontainer/example.vulnerable/index.json'.
error:   Response status code does not indicate success: 424 ("example.vulnerable" failed Phylum analysis).
error: Value cannot be null. (Parameter 'version')

If a version range is accepted by the manifest, the package manager will automatically attempt to use a version that passes Phylum's policy.

nuget

To use the Phylum NuGet registry, the original nuget.org registry first needs to be disabled:

nuget sources Disable -Name nuget.org

Once the official registry is disabled, the Phylum source can be added. If you're not running Windows, you'll also have to add the --store-password-in-clear-text flag.

nuget sources Add \
    -Source https://nuget.phylum.io/v3/index.json\
    -ProtocolVersion 3 \
    -Name Phylum
    -UserName <PHYLUM_ORG>/<PHYLUM_GROUP>
    -Password <PHYLUM_API_KEY>

⚠️ WARNING ⚠️

Do not accidentally save your token into your shell history.

A blocked package will show up in nuget output as missing:

Package 'Example.Vulnerable 1.2.3' is not found in the following primary source(s): 'https://nuget.phylum.io/v3/index.json'. Please verify all your online package sources are available (OR) package id, version are specified correctly.

If all versions of a package are blocked, it will be explicitly pointed out as having failed analysis:

Feeds used:
  https://nuget.phylum.io/v3/index.json

Installing package 'Example.Vulnerable' to '/private/tmp/path'.
  GET https://nuget.phylum.io/v3/registration5-gz-semver2/example.vulnerable/index.json
  FailedDependency https://nuget.phylum.io/v3/registration5-gz-semver2/example.vulnerable/index.json 2399ms
An error occurred while retrieving package metadata for 'Example.Vulnerable' from source 'Phylum'.
  Response status code does not indicate success: 424 ("example.vulnerable" failed Phylum analysis).

If a version range is accepted by the manifest, the package manager will automatically attempt to use a version that passes Phylum's policy.