Plan
active
GitHub npm Firewall Blocks Malicious Packages at Install Time
- Engineer — Plan: A new GitHub-native install-time gate for npm is worth evaluating this quarter to reduce supply-chain risk in CI/CD pipelines; enroll repositories in the public preview and assess coverage gaps before the feature reaches general availability.
- SOC/IR — Skip
- Leader — Learn: GitHub’s npm firewall is a new supply-chain control to track as it matures from preview — file it for the next dependency-risk review rather than taking immediate action.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.