Web

GitHub Package Firewall Enters Public Preview for Enterprise

GitHub has announced the public preview of a new package firewall designed to combat the rising tide of malware attacks that exploit systems during package installation.

Radwan AbdulhadiEditor and technology writer

Published: October 20, 2026 · Updated: October 20, 2026 · 3 min read

GitHub Package Firewall Enters Public Preview for Enterprise — Image: GitHub Changelog

Addressing Installation-Time Malware Risks

An increasing number of malware attacks target development environments by exploiting systems directly at package installation time. These malicious payloads can harvest credentials on developer workstations or continuous integration and continuous deployment (CI/CD) hosts without even needing to execute the package's actual code. To stem this tide of supply chain threats, GitHub is introducing a dedicated package firewall capability.

The new security feature is detailed further in the official [GitHub Changelog](https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview/), outlining how the service aims to safeguard modern software development pipelines against sophisticated tampering and unauthorized data harvesting.

How the Package Firewall Operates

The package firewall sits strategically between endpoints—such as Actions runners or coding agents—and upstream package repositories. Instead of pointing directly at upstream package registries, endpoints must be configured to route their requests through the firewall.

Once configured, both metadata requests for package lists and actual package downloads flow through the firewall, which evaluates them against enterprise-defined policies. If a legitimate package happens to be blocked erroneously, users can request an exception using a workflow similar to other GitHub Advanced Security features.

Enterprise Policy Controls and Configuration

Before deploying the firewall across endpoints, administrators establish policy controls for their enterprise. The available controls include setting a configurable cooldown period, checking the GitHub Advisory Database for active malware or vulnerability alerts, and performing critical supply-chain checks such as monitoring for attestation downgrades.

Organizations looking to implement these safeguards can follow detailed guidance and step-by-step instructions available in the documentation for [Protecting endpoints with package firewall](https://docs.github.com/enterprise-cloud@latest/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/protecting-endpoints-with-package-firewall).

Availability, Scope, and Pricing

The package firewall is available today in public preview for all GitHub Enterprise Cloud customers, including those utilizing data-resident GitHub Enterprise Cloud. At this current stage, support is limited exclusively to npm packages while the platform scales up its underlying infrastructure.

During the public preview period, the service is provided completely free of charge. However, once the capability transitions to general availability, usage will be billed on a metered basis similar to existing Actions billing structures.

Community Engagement and Future Development

As GitHub continues to scale the infrastructure and develop additional features based on direct customer demand, developers and enterprise administrators are encouraged to share feedback and participate in ongoing conversations.

Interested users can join the broader conversation, report feedback, and connect with peers by visiting the [GitHub Community](https://github.com/orgs/community/discussions/210809) discussion board dedicated to the package firewall rollout.