GitHub Previews npm Firewall to Block Packages That Fail Security Policies
Summary
GitHub previewed an npm package firewall for Enterprise Cloud that checks metadata and downloads against malware advisories and package-age policies, blocking packages that fail configured rules. Administrators can approve exceptions.
Key points
- The public-preview firewall is available to GitHub Enterprise Cloud customers and currently supports npm packages.
- It sits between endpoints or internal registries and upstream package repositories, checking metadata requests and package downloads.
- Administrators can set a minimum package age from 1 to 365 days; the default is 1 day, and setting it to 0 disables the cooldown.
- Users can request exceptions for packages blocked in error; enterprise administrators and security managers can approve them.
- Rust 1.100 is scheduled to add a configurable minimum publish age, with a seven-day default when the setting is unspecified.
- Cooldowns can give security researchers and maintainers time to identify malicious releases, but legitimate updates may also be delayed, and malicious code can evade detection until after the waiting period.
Article Details
- Event Type
- GitHub announced a public-preview npm package firewall for GitHub Enterprise Cloud customers.
- Impact
- The firewall checks package metadata requests and downloads against administrator-configured policies, including minimum package age and malware advisories, and blocks packages that fail those checks. It is intended to reduce the risk of malicious packages being installed by users, coding agents, and CI/CD hosts. Administrators can approve exception requests for packages blocked erroneously. A cooldown can delay legitimate fixes, and package age alone does not ensure that a release is harmless.
Vendors
Products
GitHub Enterprise CloudThe feature, which currently supports only npm packages, is available in public preview for all GitHub Enterprise Cloud customers, including data-resident GitHub Enterprise Cloud.npmGitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time.