Understand this story
GitHub has opened Package Firewall as a public preview to Enterprise Cloud customers. The firewall inspects package queries and downloads according to centralized security policies, and currently supports only npm packages. Administrators can set a waiting period after a new version is released and block based on malware and vulnerability information from the GitHub Advisory Database; when a new version first introduces install scripts such as preinstall or postinstall, or lacks the SLSA provenance that previous versions had, the firewall blocks the download. The firewall sits between clients and upstream package sources, and coding agents and CI/CD hosts must route their requests through the service for it to take effect. The preview is free, and general availability will be billed by usage; GitHub has not announced the general availability date or specific pricing.
AI-generated from public reports
Latest development · Report
GitHub Package Firewall opens public preview, blocking malicious npm packagesDevelopments
1 confirmed developments
- Source:heise online
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 23
heise online
GitHub Package Firewall opens public preview, blocking malicious npm packages
GitHub is opening Package Firewall as a public preview to Enterprise Cloud customers, checking package queries and downloads against centralized security policies; currently only npm packages are supported. Administrators can set a waiting period after a new version is released, block based on malware and vulnerability information from the GitHub Advisory Database, and prevent downloads when install scripts such as preinstall or postinstall appear for the first time in a new version or when SLSA provenance that previous versions had is missing. The firewall sits between clients and upstream package sources, so coding agents and CI/CD hosts must route their requests through the service for it to take effect; it is free during the preview, and general availability will be billed by usage. GitHub has not announced the general availability date or specific pricing.