GitHub launches package firewall for npm in public preview

GitHub opened a public preview of its package firewall on October 20 for all GitHub Enterprise Cloud customers, including those with data residency. The service sits between runners and upstream registries, checking metadata and downloads against enterprise policy with cooldowns and supply-chain checks; only npm is supported and it is free during preview.

• Preview available to all GitHub Enterprise Cloud customers, including data residency
• Enterprise-level policy: version cooldown, Advisory Database, supply-chain checks
• Only npm supported; metered billing planned at general availability
• Blocked packages can be appealed through an exception workflow