A package is usually blocked for one of five reasons: it is not on the approved list, a version is flagged for a known vulnerability, the licence is not allowed, it is too new to trust yet, or it failed a malware or integrity check. Read the block message first, then file the right request.
Start with the message
A good block message names the rule that fired. If yours only says "forbidden" or returns an HTTP 403, ask the platform team to add the policy name to the response. Developers who guess waste days.
The five common causes and the fix
| Cause | What it means | What to do |
|---|---|---|
| Not approved | Nobody has reviewed this package for your organisation | File an intake request with purpose and version |
| Vulnerable version | The version has a known advisory | Move to a fixed version, or request a time limited exception |
| Licence not allowed | The licence is outside the allowed set | Pick an alternative, or ask the licence reviewer about your use |
| Too new | The version was published recently and is held for a cooling period | Use the previous approved version, or wait |
| Integrity or malware check | The package failed a hash or reputation check | Do not work around it; report it to security |
What to put in an intake request
Reviewers move quickly when the request is complete:
- Package name and exact version, plus the registry it comes from.
- What you need it for and what you tried first.
- Where it will run: a build tool, an internal service or a shipped product.
- A link to the repository and the failing build.
- A target date, if one genuinely exists.
Skip the pleading. A clear purpose does more than urgency.
Things not to do
Do not edit the registry URL in your project file to reach the public registry. Do not vendor the code into your repository to dodge the gate. Do not paste a download link into a build script. Each of these defeats the control, appears in logs, and can turn a minor request into a policy incident. Vendored code still needs review, which our post on exceptions for vendored or forked code explains.
If the block is blocking production work, there is usually an emergency path. Ask for it by name, and expect a record afterwards.
What reviewers can do to help you
If you own the platform, publish a short status page for requests, show the queue age, and send an alternative suggestion with every rejection. A rejection with an alternative costs the developer an hour; a bare rejection costs a week.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a vulnerable version is flagged and what the fixed version options are.
Quick check
Can I ask for a one-off exception to build today?
Usually yes, through the exception or emergency path your organisation defines. Expect it to be time limited, approved by someone other than you, and recorded.
Why is a package blocked when my laptop installs it fine?
Your laptop may reach a public registry directly, while CI and the mirror apply policy. Passing locally does not mean it is approved.
Safeguard policies and gates can return the rule name with every block, and the free scan at gold.safeguard.sh/scan lets you check a project before you file a request.
Last reviewed: 19 October 2026.
