Skip to content
NewA calmer, faster ZeroHour
StoryToolsinfo

GitHub previews npm package firewall that blocks installs by policy

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

GitHub Enterprise Cloud customers can preview an npm firewall that blocks malware, severe vulnerabilities, and too-new packages before install.

GitHub is previewing a package firewall that checks npm packages against an enterprise policy before they install. It sits between endpoints or internal registries and upstream npm, and developers enable it by pointing npm at the firewall. Checks run before a package reaches a laptop, a build, or a coding agent. Controls cover known malware, vulnerability severity (critical by default), SLSA attestation downgrades, newly added install scripts, and a package-age cooldown of 1 to 365 days that defaults to one day and can be set to zero. The public preview is for all GitHub Enterprise Cloud customers, including data-resident tenants, and currently supports only npm. The same launch adds AI Scan, a Copilot security extension, Dependabot reachability analysis, and Agentic Autofix.

Key facts
  • Public preview for GitHub Enterprise Cloud, including data-resident tenants; npm only.
  • Cooldown uses package metadata dates; default one day, range 1–365, or 0 to disable.
  • Install-script control flags new preinstall or postinstall hooks.
  • Enterprise admins can approve exceptions for blocked packages.
  • AI Scan covers PHP, Shell, and COBOL and can scan merged code on demand.
  • Agentic Autofix spans GitHub tools and more than 70 partner tools.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Help Net SecurityAI Scan languages, on-demand merged-code scans, Autofix scope, and call-path reachability.
  • The Hacker NewsPreview scope, severity default, SLSA checks, cooldown range, and admin exceptions.
Vendors
GitHubMicrosoft
Products
npm firewallnpmRustCargoDependabotGitHub Copilot
Organizations
Socket

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Help Net SecurityFirst report

    GitHub npm package firewall can block new versions before install

    Enterprises can set a cooldown, alongside AI Scan, Copilot checks, and Dependabot reachability ranking.

  2. · 1d ago The Hacker News

    GitHub previews npm firewall that blocks packages at install

    Enterprise Cloud customers can enforce malware advisories, severity, attestations, new install scripts and a package-age cooldown.