GitHub npm Firewall Blocks Malicious Packages at Install Time

Thu, 29 Oct 2026 17:24:45 +0000

Engineer — Plan: A new GitHub-native install-time gate for npm is worth evaluating this quarter to reduce supply-chain risk in CI/CD pipelines; enroll repositories in the public preview and assess coverage gaps before the feature reaches general availability.
SOC/IR — Skip
Leader — Learn: GitHub’s npm firewall is a new supply-chain control to track as it matures from preview — file it for the next dependency-risk review rather than taking immediate action.

Dependency-Security on CuraSec