[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWf4bwSomN_KYZV9guReDl_ZifcABFtumO-Oj3KG1Y4E":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"006f3646-2b1d-4ddc-98fd-a7c8fef63b6e","GitHub’s npm package firewall can block brand-new versions before they install","github-s-npm-package-firewall-can-block-brand-new-versions-before-they-install-bc0c74","GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall. The checks run before a package reaches a laptop, a build, or a coding agent. GitHub says AI agents are helping developers build more software, faster, and the firewall is one of four security additions aimed at … More → The post GitHub’s npm package firewall can block brand-new versions before they install appeared first on Help Net Security.","GitHub has introduced a new package firewall for npm that checks packages against enterprise policies before installation. This firewall can block known malware, critical vulnerabilities, and newly released versions of packages. It aims to catch security issues earlier in the development lifecycle, with AI assisting in scanning and remediation.","GitHub's new npm package firewall blocks new versions, malware, and critical vulnerabilities before installation.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F28\u002Fgithub-package-firewall-npm\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002F28084444\u002Fgithub-logo-2026.webp","2026-10-28T17:09:14+00:00","2026-10-28T18:00:04.68004+00:00",7,[17,20,23,25],{"name":18,"type":19},"npm","product",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":19},"Copilot",{"name":26,"type":27},"AI","technology","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":28,"icon":30,"name":31,"slug":32},null,"Tools","tools",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[],[21,18,24],{"controls":54,"vendors":139},[55,83,112],{"slug":56,"name":57,"problem":58,"products":59},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":77,"vendor_name":21,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":84,"name":85,"problem":86,"products":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":113,"name":114,"problem":115,"products":116},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":134,"product_name":135,"url":137,"description":138},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[140],{"slug":77,"name":21,"logo_path":78,"roles":141},[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"npm-package-firewall-highlights-ongoing-open-source-supply-chain-risks","npm Package Firewall Highlights Ongoing Open-Source Supply Chain Risks","The introduction of GitHub's npm package firewall underscores a persistent and growing threat: malicious or vulnerable packages entering software supply chains through open-source dependency management. Attackers frequently exploit the window between a package's release and its adoption to inject malware or typosquat legitimate packages, making early-stage filtering critical. Without automated gatekeeping, development teams may unknowingly install compromised dependencies that propagate vulnerabilities deep into production environments. This development matters because supply chain attacks have become one of the most effective vectors for large-scale compromise, as seen in incidents like SolarWinds and XZ Utils.",[148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":156,"NIST SP 800-53 SI-2: Flaw Remediation":157,"CIS Control 17: Incident Response Management":158,"OWASP A06:2021 Vulnerable and Outdated Components":159,"CIS Control 7: Continuous Vulnerability Management":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"NIS2 requires essential and important entities to address supply chain security risks, making automated pre-installation package vetting a directly relevant control for regulatory compliance.","SI-2 requires organizations to identify, report, and remediate software flaws in a timely manner, including those introduced via external libraries and packages before they reach production.","When a malicious package is detected post-installation, a practiced incident response plan is essential to contain damage quickly—the firewall's blocking capability reduces but does not eliminate the need for this response capability.","This risk category directly addresses the danger of using third-party components with known vulnerabilities or unverified provenance, which is precisely the threat GitHub's firewall is designed to intercept at installation time.","Continuously scanning dependencies for known malicious packages and critical CVEs—exactly what the npm firewall automates—is the core activity this control mandates to reduce exposure windows.","This control requires organizations to assess and address technical vulnerabilities in a timely way, which extends to open-source dependencies that may carry undisclosed or newly disclosed flaws.","Restricting which packages and versions are permitted in the build environment enforces a form of access control over the software supply chain, limiting what untrusted code can enter the development pipeline."]