GitHub Launches npm Firewall to Block Malicious Packages Before Installation
Summary: GitHub introduced a preview package firewall that inspects metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate, and it currently supports only npm packages for all GitHub Enterprise Cloud customers. The firewall sits between endpoints or internal registries and upstream package repositories, checking downloads against policy controls such as a minimum package age ranging from 1 to 365 days, with a default of 1 day.
What's compelling: The firewall is aimed at coding agents and CI/CD hosts that install dependencies automatically without explicit permission, and GitHub notes that a release escaping detection can simply outlast the cooldown, so the waiting period buys time rather than guaranteeing safety.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026