GitHub has introduced a new npm Firewall feature in public preview to help organizations block suspicious npm packages before they are installed. The package firewall is designed to act as an install time security control by inspecting package metadata requests and downloads for signs of malicious activity. According to GitHub, the feature works as a policy gate that can prevent potentially harmful packages from reaching development environments during the installation process. The capability is currently available for npm packages and is accessible to GitHub Enterprise Cloud customers, including organizations using data resident GitHub Enterprise Cloud.
The npm Firewall is designed to provide an additional layer of protection against software supply chain risks by positioning itself between endpoints or internal package registries and upstream package repositories. GitHub said the firewall can help reduce exposure to malware campaigns where compromised packages are introduced into development workflows. Such risks have become increasingly important as organizations rely on automated tools, artificial intelligence agents, and continuous integration and delivery (CI/CD) systems that may install dependencies automatically while completing tasks or building applications. By checking package activity before installation, the firewall aims to help security teams apply preventive controls without requiring every package decision to be handled manually. Administrators can configure multiple policy controls through the firewall to determine which packages are allowed or blocked. These controls include blocking packages associated with known malware by checking against GitHub Advisory Database records, as well as restricting package installations based on vulnerability severity. Organizations can configure vulnerability policies according to their requirements, with options ranging from blocking only critical issues to blocking vulnerabilities at high, medium, or any severity level. The firewall can also prevent attestation downgrades by comparing security attestations of requested package versions with earlier versions and stopping downloads when required SLSA attestations are missing.
Additional controls include monitoring package install scripts that may introduce security concerns. The firewall can identify newly added preinstall or postinstall scripts, which are sometimes used in software supply chain attacks to execute unwanted actions or access sensitive information. Organizations can also configure cooldown periods that prevent newly released package versions from being installed immediately. The minimum age setting can be adjusted between one and 365 days, with the default configuration applying a one day waiting period. If a package is blocked incorrectly, users can request an exception that can be reviewed and approved by enterprise administrators and security managers. The introduction of npm Firewall comes as the open source community continues exploring methods to improve dependency security. Similar approaches are being adopted across different ecosystems, including npm, Python, Microsoft Visual Studio Code, Ruby, Bun, pnpm, and Yarn, where waiting periods and additional review mechanisms are being considered to reduce risks from newly published and potentially unreviewed packages. Rust is also preparing configurable minimum publish age support in an upcoming release, allowing developers to set a waiting period before new crates can be installed. These measures aim to give security researchers and maintainers more time to identify suspicious releases before they spread widely through automated builds.
GitHub’s npm Firewall reflects broader efforts to strengthen software supply chain security by adding more controls around package installation and dependency management. While security measures such as cooldown periods can help reduce the speed at which harmful packages spread, organizations may still need exception processes to allow urgent updates when required. The feature provides security teams with additional visibility and control over package usage while supporting safer development practices across enterprise environments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
