GitHub launches npm package firewall that blocks brand-new versions

GitHub announced a package firewall that checks npm packages against an enterprise's policy before installation, blocking known malware, critical vulnerabilities and brand-new versions. It ships alongside AI Scan for pull requests, a GitHub Security extension for the Copilot app and reachability analysis for Dependabot alerts.

• Developers enable the firewall by pointing npm at it; checks run before install
• The brand-new version rule relies on release dates from package metadata
• AI Scan covers PHP, Shell and COBOL and can scan already-merged code
• Reachability analysis ranks Dependabot alerts by whether code calls the vulnerable function