BuildRiot
Sign in

CloudSource: GitHub

GitHub opens npm package firewall preview for Enterprise Cloud customers

GitHub opened a free npm package firewall preview for GitHub Enterprise Cloud customers. GitHub says it targets malicious dependencies during installation; developers must configure machines and CI runners to send package requests through the service.

By News DeskPublished here (UTC)2 min read
GitHub logo
Cover: BuildRiot

GitHub opened the GitHub package firewall public preview on October 20, 2026, for all GitHub Enterprise Cloud customers, including those with data residency. GitHub says the npm-only service targets malicious dependencies during installation on developer machines, continuous integration (CI) hosts and coding agents. Preview usage is free; GitHub plans metered billing at general availability but has announced neither rates nor a launch date. Sources: GitHub

Enterprise policies evaluate package metadata requests and downloads routed through the firewall. Setting a policy alone does not configure machines or CI runners. Endpoint setup requires a user-level.npmrc file with the enterprise registry and an enterprise-member token. Creators Toolbox’s report provides no independent tests of installation overhead or protection effectiveness. Sources: GitHub, Creators Toolbox

Malware blocking, attestation-downgrade blocking and blocking of newly introduced installation scripts default to on. Vulnerability blocking defaults to Critical only. Attestation-downgrade blocking catches versions missing supply-chain attestations when earlier versions had them. The minimum package age defaults to one day, accepts 1–365 days and is disabled with zero. An age restriction can correctly block a needed security fix without a detection error. Sources: GitHub

Artifactory integration is experimental. Administrators can combine a firewall-backed npm remote with private repositories in a virtual repository. GitHub’s documentation instructs administrators to remove direct public-registry remotes to prevent bypass. In GitHub’s community discussion, author ahpook said the firewall retrieves packages only from npmjs.org, with no configurable upstreams. Sources: GitHub, GitHub Community

Blocked npm and CI requests include exception-request links. Enterprise administrators and security managers can approve specific versions or use a wildcard (*) for broader approval. They can also revoke overrides. Documented visibility includes block output, searchable bypass requests, decision comments and policy overrides. Sources: GitHub

What to do

  1. To adopt the preview, configure enterprise firewall policies and review the Critical-only vulnerability threshold and one-day minimum package age.
  2. Configure the user-level.npmrc on developer machines and CI runners with the enterprise registry and an enterprise-member token.
  3. For experimental Artifactory integration, combine a firewall-backed npm remote with private repositories in a virtual repository and remove direct public-registry remotes to prevent bypass. Sources: GitHub

Why it matters

GitHub positions the firewall as dependency security during npm installation. Enforcement depends on routing requests through the service, and age restrictions can delay needed security fixes.

Attribution

Sources

  1. 1GitHubGitHub package firewall in public previewSource published (UTC)
  2. 2Creators ToolboxGitHub package firewall in public previewSource published (UTC)
  3. 3GitHubProtecting endpoints with GitHub package firewall
  4. 4GitHub CommunityProtecting endpoints from malware with package firewall

Read the original source for full details and context.

Report a problem

Links, dates or what you expected. Do not include passwords or private data.

More on Cloud

All Cloud stories

Review · AI

Elastic’s Linux profiling preview: Setup, requirements and limits

Elastic says its OpenTelemetry Profiling integration collects continuous CPU profiles on Linux through eBPF. It requires no application instrumentation or restarts, according to Elastic. Version 0.0.1 is a technical preview. OpenTelemetry Profiles remains Alpha. Elastic’s October 14, 2026, walkthrough performs the one-time Universal Profiling storage initialization as superuser. It then configures a Fleet policy with samples_per_second=20 and enrolls the Linux agent. To verify collection, Elastic directs users to Infrastructure > Universal Profiling > Flamegraphs. Users select the traffic window and filter process.executable.name: "java"; agent health alone is insufficient. Elastic reports 30,150 PetClinic requests in four minutes at slightly over half a CPU core. The walkthrough does not report a profiling-overhead measurement.

Elastic