GitHub previews npm firewall that blocks packages at install
Original title: GitHub Launches npm Firewall to Block Malicious Packages Before Installation
Enterprise Cloud customers can enforce malware advisories, severity, attestations, new install scripts and a package-age cooldown.
GitHub is previewing a package firewall that sits between endpoints or internal registries and upstream npm repositories and blocks downloads that fail policy. It is in public preview for all GitHub Enterprise Cloud customers, including data-resident tenants, and currently supports only npm. Controls cover known malware, vulnerability severity, SLSA attestation downgrades, newly added install scripts and a cooldown of 1 to 365 days, defaulting to one day. The article also notes Rust 1.100, due November 12, 2026, will add a configurable minimum crate publish age.
- Vulnerability blocking defaults to critical severity and can be widened by administrators.
- The install-script control looks for new preinstall or postinstall hooks.
- Cooldown can be disabled by setting the minimum age to 0.
- Blocked packages can be allowed through an exception approved by enterprise admins.
- If unset, Cargo’s global minimum publish age defaults to seven days.
- Products
- npm firewallnpmRustCargo
- Organizations
- Socket
From the original article
3 min read at thehackernews.com
GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitHub said. The feature, which currently supports only npm packages, is available in public preview
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.