Can the JetBrains plugin check a package before you install it?

Not in the way the question implies. According to Safeguard's docs, the JetBrains plugin scans your manifest for vulnerabilities after you add a dependency. The inline check that flags typosquats before an install runs is documented for VS Code and Cursor only. For a pre-install check from JetBrains, use the CLI or Gold lookups.

What does the plugin do when you add a dependency?

The plugin works on manifests. Add a package to package.json, pom.xml, build.gradle, go.mod or another supported file, then scan. Right-click the manifest and choose Safeguard, then Scan File for Vulnerabilities, or use Tools, then Safeguard, then Scan Project.

Results appear in the Safeguard tool window at the bottom of the IDE, as a tree of packages with their CVEs. Double-click a CVE to see its CVSS and CWE details. Inline highlighting uses red for critical, orange for high, yellow for medium and blue for low.

This is a check on what you declared, not a gate on what you are about to install. If a malicious package has no CVE, a vulnerability scan has little to say about it.

What is the pre-install check, and where does it exist?

Safeguard's IDE support page describes Package Firewall inline checks as an editor-side companion to the install-time proxy. They evaluate package names as you type, before any install, and flag typosquats, namespace confusion and known-malicious names. The same page says this applies to VS Code and Cursor, and adds: "The JetBrains plugin's published docs do not mention this feature."

So in JetBrains do not expect a warning badge beside a suspicious name. Plan for another step.

What can you do instead, from a JetBrains IDE?

You have three documented options.

1. The CLI package check. Safeguard's Package Firewall docs show a one-shot check that exits 1 on a block: safeguard pkgfw check, passing the ecosystem, package name and version as options. Run it in the IDE's terminal before you add an unfamiliar package. The firewall supports npm and pip, so other ecosystems are not covered by that command.
2. The local proxy. safeguard pkgfw start runs a local or CI proxy so installs fetch through it. The docs recommend starting in audit mode, which records decisions without blocking, so you can see the effect first. They also say the feature is enabled through an admin-toggleable flag.
3. A manual look. Gold Open Source, at gold.safeguard.sh, lets you look up a package for free, and a Chrome extension exists for the same purpose.

Open the IDE gate demo

Which habit works on a team?

Treat the plugin as the second line, not the first. A reasonable routine: before adding an unfamiliar dependency, check its name and publisher with the CLI command; after adding it, scan the manifest in the plugin; before pushing, fix what it finds. The fix flow uses Alt plus Enter on a flagged dependency and a Fix with Safeguard AI action with Safe, Balanced or Aggressive strategies, and you review the diff before applying it.

What does the documentation not say?

The JetBrains docs do not describe a chat panel, SBOM export or inline package verdicts. They require IDE 2023.3 or later and JDK 17 or later. Public package scanning works without login; features that need the backend need sign in through the OAuth device flow.

What to do

1. Add safeguard pkgfw check to your "new dependency" habit for npm and pip packages.
2. Scan the manifest in the JetBrains plugin after every dependency change.
3. Ask your admin to enable Package Firewall in audit mode and read a week of results.
4. If your team splits between JetBrains and VS Code, tell the JetBrains users about the gap.

Quick check

Sources

• Safeguard docs, IDE support
• Safeguard docs, Package Firewall

Last reviewed: 18 October 2026.