tag: Dependency-Security · 1 items
- Engineer — Plan: A new GitHub-native install-time gate for npm is worth evaluating this quarter to reduce supply-chain risk in CI/CD pipelines; enroll repositories in the public preview and assess coverage gaps before the feature reaches general availability.
- SOC/IR — Skip
- Leader — Learn: GitHub’s npm firewall is a new supply-chain control to track as it matures from preview — file it for the next dependency-risk review rather than taking immediate action.