GitHub npm package firewall can block new versions before install
Original title: GitHub’s npm package firewall can block brand-new versions before they install
Enterprises can set a cooldown, alongside AI Scan, Copilot checks, and Dependabot reachability ranking.
GitHub announced a package firewall that checks npm packages against an enterprise policy before they install. It can block known malware, packages with critical vulnerabilities, and brand-new versions, and developers enable it by pointing npm at the firewall. Checks run before a package reaches a laptop, a build, or a coding agent. The same launch adds AI Scan for pull requests, a Copilot security extension, and Dependabot reachability analysis.
- New-version rules use package metadata dates, and enterprises can set their own cooldown.
- AI Scan covers PHP, Shell, and COBOL and can scan already merged code on demand.
- Agentic Autofix can remediate alerts across GitHub tools and more than 70 partner tools.
- Reachability analysis checks whether code calls a vulnerable function and shows the call path.
From the original article
2 min read at helpnetsecurity.com
GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall. The checks run before a package reaches a laptop, a build, or a coding agent.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.