GitHub adds a filter that blocks malicious software packages

GitHub has released a package firewall in public preview. It checks the software packages a company's developers and automated tools download, and blocks the ones that look malicious. It is free for now, but GitHub says it will cost money once the preview ends.

What it does

Modern software is built from many small packages written by other people. Attackers have been hiding malware in them. GitHub says a recent flood of these attacks strikes at install time, when the package is being set up. Tools that install packages without a person watching are especially exposed. These include coding agents and build systems, known as CI runners.

The firewall sits between those tools and the public package registries where packages are stored. It inspects both the lists of available packages and the downloads themselves, then applies the company's rules.

The controls available now

Administrators set the rules for their whole enterprise. GitHub lists three kinds of control today:

• A cooldown period, a waiting time before a package can be used.
• A check against the GitHub Advisory Database for malware or vulnerability warnings.
• Supply-chain checks, such as attestation downgrades.

Developer tools and build machines then point at the firewall instead of going straight to the public registries. If a safe package gets blocked by mistake, a user can ask for an exception. GitHub says the process works like other GitHub Advanced Security features.

Who can use it

The preview is open to all GitHub Enterprise Cloud customers. That includes the version with data residency, which keeps a company's data in a chosen region. It is not described as available on other GitHub plans.

There is a big limit. The firewall supports only npm packages for now. Npm is the package system for JavaScript. Teams that rely on other kinds of packages are not covered yet.

What it will cost

The service is free during the preview. When it reaches general availability, GitHub says it will be charged by metered usage, similar to how Actions billing works. GitHub's announcement gives no prices and no date for that full release.

What to do

Companies on GitHub Enterprise Cloud that build with npm can try it now at no charge. They should also budget for usage-based fees later. GitHub points to its setup guide, called Protecting endpoints with package firewall, for detailed steps.