GitHub's package firewall enters public preview to block bad npm installs

GitHub has put a package firewall into public preview. It sits between endpoints such as GitHub Actions runners, developer machines and AI coding agents on one side, and the upstream npm registry on the other. Every metadata request and package download passes through it, and packages that fail enterprise policy are blocked.

The problem it targets is malware that strikes at install time. Some attacks harvest credentials on CI/CD hosts or developer workstations without ever running the package's own code, so scanning code after install is too late. The firewall checks requests before the package lands.

Administrators set policy at the enterprise level. Controls available today include a cooldown period for newly published versions, checks against the GitHub Advisory Database for known malware or vulnerabilities, attestation enforcement and install script detection. If a package is blocked by mistake, users can request an exception through a workflow similar to other GitHub Advanced Security features.

There are real limits. It is available to GitHub Enterprise Cloud customers, including data residency, and it supports npm only. Endpoints must be configured to use the firewall instead of pointing straight at the registry, and protection covers only requests actually routed through it. It is free during preview, and at general availability it will be charged on metered usage, similar to Actions billing.

Our take

Putting the checkpoint at the registry boundary is the right place to stop install-time attacks, especially as coding agents pull packages with little human review. The catch is that it only protects what you route through it, so the rollout work falls on you.