# GitHub Package Firewall Enters Public Preview for Enterprise Cloud

> GitHub launched a public preview of its package firewall to block malicious install scripts on CI runners and coding agents. It currently supports only npm.

- URL: https://roobrief.com/en/posts/github-package-firewall
- Language: en
- Published: 2026-10-22T01:00:00.000Z
- Tags: dev
- Source: https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview/

**GitHub has opened a public preview of its Package Firewall to block malware during dependency installation, but it requires GitHub Enterprise Cloud and currently supports only npm packages.**

On Oct. 20, 2026, GitHub announced the public preview of its Package Firewall in a blog post. The feature is an inline inspection layer designed to stop malicious scripts from running when developer workstations, CI runners, or coding agents install dependencies. It is available to all GitHub Enterprise Cloud (GHEC) customers, including instances configured with data residency.

## Who can use it and how it is billed

Package Firewall is not available across all GitHub plans. It is restricted to GitHub Enterprise Cloud, leaving out personal accounts (Free and Pro) and GitHub Team plans.

| Plan | Package Firewall Support | Preview Pricing | General Availability (GA) Pricing | Ecosystem Support |
|---|---|---|---|---|
| GitHub Free / Team | Not supported | N/A | N/A | N/A |
| GitHub Enterprise Cloud (GHEC) | Supported (including data residency) | Free | Metered usage (planned) | npm (single support) |

During the public preview, the firewall is free to use. GitHub stated that once the feature reaches general availability (GA), it will transition to a metered usage model similar to GitHub Actions billing. Specific per-unit rates and a GA release date have not been announced.

## What it inspects and where it falls short

Traditional software supply chain security often relies on post-commit repository scanning or vulnerability alerts. However, recent attacks increasingly exploit installation hooks (such as `preinstall` scripts) to extract environment secrets and API keys before any application code executes. Autonomous coding agents and CI runners are especially vulnerable because they routinely install packages without human intervention to finish tasks.

The package firewall sits between endpoints and the public registry (`registry.npmjs.org`), intercepting both metadata requests and package downloads in real time. Enterprise administrators can enforce four core policy rules:

1. **Block known malware**: Automatically drops packages flagged in the GitHub Advisory Database.
2. **Block vulnerability advisories**: Restricts versions carrying reported vulnerabilities above a chosen severity threshold.
3. **Block attestation downgrades**: Flags and blocks package updates where cryptographic provenance attestations—proof of a verified build—were present in previous versions but missing in the requested version.
4. **Cooldown period**: Delays installation of newly published versions for a set window to give the security community time to identify and report threats.

The primary limitation today is ecosystem support: **Package Firewall currently supports only npm packages**. Other major registries such as Python's PyPI, Java's Maven, and Rust's Cargo are not protected.

## Setup requirements and exception workflow pitfalls

To enable Package Firewall, enterprise administrators turn on the policy in enterprise settings and configure endpoint package managers (`.npmrc`) to route traffic through the firewall instead of directly to npm.

When a legitimate internal package or urgent release is blocked by a cooldown or policy rule, the CLI output or CI logs provide a direct URL to request an exception. Developers can submit a justification through this link, which enterprise security administrators review and approve through a workflow similar to GitHub Advanced Security (GHAS).

In fast-moving agentic workflows where dozens of background agents run in parallel, false positives can halt builds entirely until a human security admin manually reviews the request. Setting overly long cooldown windows can also delay routine dependency upgrades. Teams should start with short cooldown periods and designate clear exception approvers before rolling the policy out broadly.

## What to watch next

GitHub indicated it will expand infrastructure and add features based on user feedback. Key points to track include when support extends to other package ecosystems like PyPI and how metered pricing will impact monthly CI/CD budgets once the feature reaches general availability.

## Sources

- [GitHub package firewall in public preview](https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview/) (The GitHub Blog)
- [Protecting endpoints with package firewall](https://docs.github.com/en/enterprise-cloud@latest/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/protecting-endpoints-with-package-firewall) (GitHub Docs)