GitHub launches npm firewall to block malicious packages

GitHub has announced a new npm package firewall in public preview, designed to block installation of suspicious npm packages at install time. The firewall acts as an install-time policy gate by inspecting both metadata requests and package downloads, sitting between endpoints or internal registries and the upstream package registries. It checks downloads against policy controls and blocks those that fail, with the npm ecosystem currently the only supported target. The feature is available to all GitHub Enterprise Cloud customers in public preview, including data-resident Enterprise Cloud deployments.

Administrators can configure policy rules to govern what is blocked, such as known malware advisories via the GitHub Advisory Database, vulnerability severities, SLSA attestations, and newly introduced install scripts. A cooldown mechanism is also supported, preventing versions newer than a configured minimum age from being installed (1–365 days, default 1 day). If a package is blocked erroneously, an exception can be requested and approved by enterprise admins and security managers.

The announcement notes the development context around Rust 1.100, slated for 12 November 2026, which will introduce a configurable minimum publish age in Cargo, alongside broader trends of cooldown policies across multiple ecosystems in an effort to slow the spread of malicious releases.