diff --git a/manifests/mirror.pp b/manifests/mirror.pp
index e0df1de..8c8501f 100644
--- a/manifests/mirror.pp
+++ b/manifests/mirror.pp
@@ -17,11 +17,12 @@
 # Class to set up bandersnatch mirroring.
 #
 class bandersnatch::mirror (
-  $group       = 'root',
-  $hash_index  = false,
-  $mirror_root = '/srv/static/mirror',
-  $static_root = '/srv/static',
-  $user        = 'root',
+  $group             = 'root',
+  $hash_index        = false,
+  $package_blacklist = [],
+  $mirror_root       = '/srv/static/mirror',
+  $static_root       = '/srv/static',
+  $user              = 'root',
 ) {
 
   if ! defined(File[$static_root]) {
diff --git a/templates/bandersnatch.conf.erb b/templates/bandersnatch.conf.erb
index bbef178..455c42a 100644
--- a/templates/bandersnatch.conf.erb
+++ b/templates/bandersnatch.conf.erb
@@ -40,4 +40,13 @@ delete-packages = true
 ; generate daily access statistics that will be aggregated on the master PyPI.
 access-log-pattern = /var/log/apache2/pypi.*openstack.org_access.*
 
+<% if not @package_blacklist.empty? -%>
+; blacklist
+; List of PyPI packages not to sync - Useful if malicious packages are mirrored
+[blacklist]
+packages =
+<% @package_blacklist.each do |package| -%>
+  <%= package %>
+<% end -%>
+<% end -%>
 ; vim: set ft=cfg: