GitHub package firewall: it only protects what you route through it

GitHub's package firewall entered public preview on October 20, 2026 for GitHub Enterprise Cloud (npm only). Six slides: what shipped, the five default policy controls (malware On, vulnerabilities Critical only, attestation downgrades On, new install scripts On, 1-day minimum package age), the routing catch, and a safe pilot plan.

Sources: https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview/ and https://docs.github.com/enterprise-cloud@latest/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/protecting-endpoints-with-package-firewall

Written with AI assistance.

Transcript