GitHub Package Firewall Enters Public Preview for Enterprise Cloud, Free for Now
GitHub's package firewall is in public preview for Enterprise Cloud customers, free during preview, npm-only, with metered billing planned at general availability.
GitHub has launched a package firewall in public preview for all GitHub Enterprise Cloud customers, including those with data residency. The service is free during the preview; once it reaches general availability, GitHub says it will be charged on metered usage similar to Actions billing.
The tool sits between endpoints such as Actions runners and coding agents and the upstream package repositories. It inspects both metadata requests and package downloads for signs of malicious activity — aimed at attacks that strike at install time, harvesting credentials on CI/CD hosts or developer workstations without ever running the package’s code, according to GitHub.
Admins set the policy first
Administrators configure policy controls for their enterprise. The controls available today include a configurable cooldown period, checks against the GitHub Advisory Database for malware or vulnerability alerts, and supply-chain checks such as attestation downgrades.
Endpoints then need configuration to route their requests through the firewall instead of pointing directly at upstream registries. Package lists and downloads flow through it and are evaluated against the policy. If a package is blocked by mistake, users can request an exception through a workflow similar to other GitHub Advanced Security features.
npm only, for now
The firewall currently supports npm packages only. GitHub says the public preview period lets it scale up the infrastructure behind the service and add features based on customer demand.
If your enterprise relies on other package ecosystems, the firewall won’t cover them yet. Setup instructions are in GitHub’s documentation under “Protecting endpoints with package firewall,” and discussion is open in GitHub Community.
For related security tooling, see our coverage of GitHub’s AI Scan metrics in the security overview and its purpose-built model for leaked secret detection.
Sources
- GitHub package firewall in public preview — GitHub Changelog
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
