GitHub says its new package firewall, in public preview for Enterprise Cloud only, screens npm packages for malware at install time. GitHub's docs show limits: npm only, each endpoint must be configured to use it, and direct registry remotes can bypass it. Default minimum package age is 1 day, while GitHub's Dependabot default cooldown is 3 days. Free in preview; metered billing at GA, no rates given.
https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview/
The GitHub BlogGitHub package firewall in public preview - GitHub ChangelogAn increasing number of malware attacks exploit systems at package installation time, harvesting credentials on CI/CD hosts or developer workstations without even running the package’s code. To stem this tide…