Security · Updated 29 Oct, 03:56 pm IST
GitHub previews npm Firewall to block malicious packages at install time
Why it matters for readers: If you use or study package ecosystems, this shows a new layer of protection at install time rather than post-install scanning.
- The npm Firewall inspects metadata requests and package downloads and acts as an install-time policy gate.1
- The feature currently supports only npm packages and is available in public preview for GitHub Enterprise Cloud customers, including data-resident instances.1
- The firewall sits between endpoints or internal registries and upstream package repositories to deter malware introduced during package installation.1
- Administrators must configure policy controls—examples include minimum package age checks and blocking known malware via GitHub advisories.1
- GitHub highlights the risk this addresses when AI agents and CI runners automatically install dependencies without explicit user permission.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started