GitHub has introduced a new package firewall designed to prevent malicious software packages from being installed in development environments, adding another layer of protection against software supply chain attacks.
The feature, currently available in public preview, checks package metadata requests and downloads for suspicious activity before allowing dependencies to reach developers’ systems.
According to GitHub, the package firewall acts as an installation-time security gate between endpoints, internal package registries and upstream repositories. Instead of allowing coding environments and automated build systems to download packages directly from public registries, organizations can route those requests through the firewall for security checks.
The new protection is particularly important as AI coding agents and continuous integration (CI) runners increasingly install software dependencies automatically. These automated processes can introduce security risks when malicious packages are downloaded and executed without developers explicitly reviewing them.
GitHub’s package firewall currently supports npm packages and is available in public preview to GitHub Enterprise Cloud customers, including customers using data-resident GitHub Enterprise Cloud.
Administrators can configure several security policies to determine which packages are allowed or blocked. One option checks requested packages against the GitHub Advisory Database and blocks versions associated with active malware advisories.
The firewall can also prevent installations of packages affected by known security vulnerabilities. Administrators can select the vulnerability severity threshold, ranging from critical vulnerabilities only to any reported severity.
Another security control focuses on software supply chain attestations. The firewall can detect attestation downgrades by comparing the security attestations of requested package versions with earlier releases. It can also block packages that lack the required SLSA attestation.
GitHub has also introduced protection against suspicious installation scripts. The firewall checks whether a package has recently introduced new preinstall or postinstall scripts, which can execute automatically during installation and potentially be abused to steal credentials or other sensitive information.
Organizations can additionally configure a minimum package age, preventing newly published versions from being installed immediately. The cooldown period can be configured between one and 365 days, with a default setting of one day. Administrators can disable this restriction by setting the value to zero.
If a legitimate package is incorrectly blocked, developers can submit an exception request. Enterprise administrators and security managers can review and approve these requests to restore access.
The announcement comes as other software ecosystems introduce similar protections against newly published malicious dependencies.
Rust is preparing to introduce configurable minimum package publication ages in Cargo through the global-min-publish-age configuration option. The feature is scheduled for Rust 1.100, expected on November 12, 2026, and will allow developers to delay the installation of recently published crate versions.
When no custom value is configured, Cargo is expected to apply a default seven-day waiting period, giving security researchers and package maintainers additional time to identify suspicious releases.
Cooldown periods are becoming an increasingly common defense against software supply chain attacks, particularly campaigns in which attackers compromise package maintainer accounts and publish malicious updates to trusted libraries.
Similar protections have appeared across ecosystems and development tools, including npm, Python, Ruby, Bun, pnpm, Yarn and Visual Studio Code.
However, package age restrictions are not a complete security solution. Malicious code can remain undetected beyond a configured waiting period, while legitimate security fixes may also be delayed unless administrators approve exceptions.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
GitHub’s new package firewall adds another preventive layer by combining malware intelligence, vulnerability checks, package attestations and installation-script monitoring before dependencies reach development environments.
