Skip to content
GitHub Introduces Package Firewall to Combat Malware Attacks

GitHub Introduces Package Firewall to Combat Malware Attacks

First seen 20 Oct 2026, 17:11 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 18:12 UTC
  • •GitHub's package firewall is now in public preview to prevent malware during package installations.
  • •The firewall inspects requests and downloads, allowing administrators to set customizable security policies.
  • •Currently, the service is free for GitHub Enterprise Cloud users and supports only npm packages.

GitHub has launched a package firewall in public preview to protect against malware attacks that exploit package installations. The firewall inspects metadata requests and package downloads for malicious activity, targeting CI/CD hosts and developer workstations. Administrators can set policy controls, including checks against the GitHub Advisory Database for malware and vulnerability alerts. The firewall is currently available for GitHub Enterprise Cloud customers and supports npm packages. Users can request exceptions for erroneously blocked packages. This initiative aims to enhance supply chain security by preventing the installation of compromised packages. The service is free during the preview period, with future charges based on usage expected once it reaches general availability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
GitHub package firewall launched
GitHub introduced a package firewall in public preview to enhance security against malware attacks during package installations.
Github.Blog
2026-10-20
Documentation for package firewall released
GitHub published detailed documentation on configuring and using the new package firewall feature.
docs.github.com

More articles in this cluster (2)

Extracted Entities (2)

1 / 2

Common questions

Who can use the package firewall?
The package firewall is available to all GitHub Enterprise Cloud customers.
What types of packages does the firewall support?
Currently, the package firewall only supports npm packages.
How can I configure the package firewall?
Administrators can set policy controls through the GitHub Enterprise settings under the Policies section.