A control at the point of installation
GitHub’s package firewall adds an inspection point between a development machine or build runner and a public package registry. Announced on October 20, it evaluates package metadata and downloads against enterprise policies before allowing them through. Its initial public preview supports npm packages for GitHub Enterprise Cloud customers, including customers using data residency.
Available controls include a waiting period for new package versions and checks against security advisories. The documentation also describes controls for changes in attestations and newly introduced installation scripts. Administrators must configure policy and direct the relevant endpoints through the firewall.
Preview limits
The service is free during preview, with usage-based charging planned at general availability. It is not announced here as a free permanent service or as protection for every package ecosystem. Requests that do not pass through the configured service are outside that inspection path.
CGH perspective
The first implementation question is coverage: which machines install packages, and which registry addresses do they actually use? A useful rollout would include an intentionally blocked package request and a legitimate exception, then verify that both leave an understandable record. Teams also need a plan for urgent fixes that conflict with a package-age rule. A firewall is one control in a software-supply process, not evidence that every permitted dependency is safe. CGH has not tested the preview’s detection performance.