GitHub opens public preview of Package Firewall
GitHub has opened Package Firewall as a public preview to Enterprise Cloud customers. The firewall inspects package queries and downloads according to centralized security policies, and currently supports only npm packages. Administrators can set a waiting period after a new version is released and block based on malware and vulnerability information from the GitHub Advisory Database; when a new version first introduces install scripts such as preinstall or postinstall, or lacks the SLSA provenance that previous versions had, the firewall blocks the download. The firewall sits between clients and upstream package sources, and coding agents and CI/CD hosts must route their requests through the service for it to take effect. The preview is free, and general availability will be billed by usage; GitHub has not announced the general availability date or specific pricing.
Matched fieldsTitle