GitHub Opens npm Package Firewall in Public Preview for Enterprise Cloud Customers

GitHub has put a gate in front of npm. The company announced a package firewall on Oct. 20, now in public preview for all GitHub Enterprise Cloud customers, including those on data-resident Enterprise Cloud.

It supports npm packages only.

How the firewall works

The firewall sits between endpoints or internal registries and the upstream package repositories. It inspects both metadata requests and the package downloads themselves, and it blocks anything that fails the enterprise's policy.

GitHub's stated reason: a recent flood of malware attacks that exploit systems at install time. The company says coding agents and CI runners are especially exposed because they pull dependencies to finish a task or build with no human in the loop.

Administrators set the rules first. Then coding agents and CI/CD hosts send their requests through the firewall instead of straight to the public registry.

The controls available now:

• Cooldown period. Blocks versions newer than a configured minimum age. The range is 1 to 365 days, the default is 1 day, and setting it to 0 turns it off.
• Advisory checks. Packages are checked against malware and vulnerability advisories in the GitHub Advisory Database. Administrators can set the severity threshold that triggers a block.
• Install-script filter. Per GitHub's documentation, as described by heise, the firewall can block a version that adds a preinstall or postinstall script for the first time, since those scripts can run arbitrary code.
• Attestation downgrade check. If earlier versions carried SLSA provenance attestations and the new one does not, the download is blocked. GitHub's documentation says missing attestations can point to a compromised publishing process.

A package blocked by mistake can be unblocked through an exception request, which enterprise administrators and security managers can approve. GitHub says the workflow resembles those in other GitHub Advanced Security features.

What it costs

The preview is free. GitHub says that once the service reaches general availability it will be billed on metered usage, similar to Actions billing. No general availability date has been announced.

GitHub says it is scaling up the infrastructure behind the service and adding features based on customer demand. The documentation also describes an experimental JFrog Artifactory integration, so teams can keep an internal registry and still screen public packages pulled through it.

Where it does not reach

The protection covers only requests routed through it. Package managers or internal registries have to be pointed at the firewall. Having an Enterprise Cloud account does not by itself cover every developer machine or automated build.

It also cannot vouch for what it lets through. A download that meets the configured policies is not guaranteed harmless.

The cooldown works as a delay. It targets attacks in which someone seizes a maintainer account and publishes a poisoned version of a popular package, by giving scanners and maintainers time to flag the release before automated installs pick it up. Legitimate new releases are held back by the same rule. A one-day default is a light touch. A 365-day setting would freeze most updates.

Adam Leftik, a partner product manager at GitHub, told Help Net Security the firewall relies on the release dates in package metadata, which he said is the package managers' responsibility. Enterprises can write custom policies, including their own soak time.

That means the cooldown is only as reliable as the dates the registry reports.

Part of a wider push

GitHub framed the firewall as one of four security additions aimed at catching problems earlier as AI agents help developers write more code, faster.

The other three:

• AI Scan. Checks every pull request for vulnerabilities in languages that rule-based scanning does not cover, including PHP, Shell and COBOL. It can also scan a repository on demand, which reaches code that has already merged.
• GitHub Security extension for the Copilot app. Reviews a developer's changes before a pull request exists and pulls in code scanning alerts, AI Scan findings included.
• Reachability analysis for Dependabot. Checks whether a team's code actually calls a vulnerable function, so teams can rank alerts by the call path.

Pierre Tempel, GitHub's director of product management, said Agentic Autofix can remediate alerts across GitHub tools, including AI Scan, and more than 70 partner tools.

The cooldown idea is spreading

GitHub is not alone in building in a waiting period. Over the past year, similar minimum-age settings have appeared in npm, Python, Microsoft Visual Studio Code, Ruby, Bun, pnpm and Yarn.

Rust is next. Rust 1.100, scheduled for release on Nov. 12, 2026, adds a configurable minimum publish age through a "global-min-publish-age" option in cargo/config.toml. If a user sets nothing, a seven-day wait applies by default.

That is a longer default than GitHub's one-day setting. Whether enterprises on the npm firewall move toward the Rust-style week, or keep the shorter window to avoid delaying legitimate releases, is their call. GitHub's documentation leaves the choice to administrators.