GitHub Package Firewall Preview: npm Scope and Setup Limits

GitHub announced a package firewall in public preview on October 20, 2026. It sits between developer machines, coding agents or CI runners and an upstream registry, evaluating package metadata and downloads against enterprise policy. The important boundary is architectural: administrators must route endpoints through the firewall. A policy page alone does not inspect clients that continue to contact the public registry directly.

The preview begins with npm and enterprise routing

GitHub says the preview is available to GitHub Enterprise Cloud customers, including data-resident deployments, and is free during the preview period. Only npm packages are supported today. GitHub says general-availability billing is expected to be metered in a way similar to Actions, but it has not supplied a generally available price in this announcement.

Each request uses an enterprise-specific firewall URL and an authentication token tied to a user or bot that belongs to the enterprise. The documentation says read-only public-repository access is sufficient; it also warns teams to keep the token in a secret rather than commit it. Artifactory routing exists experimentally, which is another status to preserve rather than present as finished support.

Defaults are useful starting points, not proof of a safe package

Documented controls include active malware advisories, vulnerability severity, attestation downgrades, newly introduced install scripts and a configurable package-age cooldown. GitHub lists malware, attestation-downgrade and new-install-script checks as on by default, with critical vulnerabilities as the default blocking threshold and a one-day minimum package age.

These signals reduce particular risks; they cannot establish that an allowed package is trustworthy or suitable. A new malicious version may lack a published advisory, while a legitimate urgent fix may be younger than the cooldown. Lockfiles, review of dependency changes, isolated builds and minimal CI credentials still matter. The preview should be tested as one layer rather than described as a replacement for supply-chain controls.

Design exception review before the first blocked build

A blocked npm install can produce a link for requesting an exception. Enterprise administrators and security managers can review the package, version and reason, then approve a precise version or a broader range. GitHub’s documentation explicitly notes that a wildcard broadens the exception to all versions.

For Canadian organizations, a useful pilot records which runners actually use the firewall, why each override was approved and when it expires. Test the route with a non-production workflow, confirm direct-registry paths are not silently retained, and keep the earlier configuration for recovery. Preview availability is not evidence that a particular organization has deployed the control or prevented an incident.

Sources and editorial method

We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.

GitHub: package firewall public preview ↗ — October 20, 2026 release; availability, npm-only scope and future metered-billing direction.
GitHub Docs: protecting endpoints with package firewall ↗ — Official routing, policy defaults, token and exception guidance; reviewed October 21.