GitHub package firewall enters public preview to screen npm installs for malware

GitHub ships a package firewall

GitHub has put a new package firewall into public preview, a service that sits between build infrastructure and upstream package registries and inspects traffic for signs of malicious activity. According to the changelog post announcing the feature, the tool is available immediately to all GitHub Enterprise Cloud customers, including those on data-resident plans, and is free for the duration of the preview.

The post frames the feature as a response to a shift in how supply-chain attacks operate. GitHub says a growing share of malware campaigns now exploit the package installation step itself, stealing credentials from CI/CD hosts or developer workstations, in some cases without the package's own code ever executing. The announcement, dated October 20, 2026, also surfaced on the front page of Hacker News.

How the firewall works

The firewall is an inline proxy rather than a scanning tool that runs after the fact. Endpoints such as GitHub Actions runners and coding agents are reconfigured to send their package requests to the firewall instead of pointing directly at the upstream registries. Both metadata requests, like package listings, and the actual package downloads then flow through the firewall, where each request is evaluated against enterprise policy before being allowed through.

Administrators configure those policies at the enterprise level. Three controls are available at launch:

• A configurable cooldown period.
• Checks against the GitHub Advisory Database for known malware and vulnerability alerts.
• Supply-chain checks, including attestation downgrades.

The changelog post does not spell out exactly how each control behaves, such as what the cooldown period defers or what counts as an attestation downgrade. When the firewall blocks a package that turns out to be benign, users can request an exception through a workflow GitHub describes as similar to those used by its Advanced Security features.

Availability and pricing

GitHub says the public preview period is partly about scaling up the infrastructure behind the service and adding features based on customer demand. The firewall is free while in preview. Once it reaches general availability, it will move to metered, usage-based billing comparable to how GitHub charges for Actions.

The main limitation is ecosystem coverage: the firewall currently supports npm packages only. The post does not say when support for other registries, such as Maven, NuGet or PyPI, might arrive.

Why it matters

Install-time compromise has become a persistent problem for package ecosystems, and the firewall represents a structural answer rather than a reactive one. Because enforcement happens at the network layer, security teams get centralized, policy-driven control over every dependency fetch from covered endpoints, instead of relying on individual developers or pipelines to wire up scanning tools correctly. Controls of this kind also target the typical lifecycle of malicious packages, which are frequently published, downloaded by victims and removed within a short window.

Two details in the announcement stand out for where development is heading. First, coding agents are listed alongside CI runners as first-class endpoint types, an acknowledgment that AI assistants now install dependencies autonomously and at high volume, widening the attack surface. Second, the exception workflow signals that GitHub expects false positives to be a routine operational cost of inline filtering, not an edge case.

The caveats are real: npm-only support limits the firewall's usefulness for polyglot organizations today, every runner and agent needs reconfiguration to route through the proxy, and metered pricing after general availability means larger installations should model the cost before committing. But for enterprises already standardized on GitHub Enterprise Cloud with heavy npm usage, the preview offers a low-friction way to put a hard checkpoint between malicious packages and the credentials that live on build machines.