Technology2 min read

GitHub package firewall

By · Published by Everything Blog

In short

GitHub introduces the package firewall to protect against malicious attacks during package installation, inspecting metadata requests and downloads for signs of malicious activity. Available in public preview for all GitHub Enterprise Cloud customers, it includes policy controls for cooldown periods, advisory database checks, and supply-chain checks. Endpoint configuration is needed, and exceptions can be requested for blocked packages. The package firewall is free during the preview period and will be charged based on usage when general availability is reached, currently supporting npm packages.

Key points

  • GitHub introduces the package firewall to protect against malicious attacks during packag…: GitHub introduces the package firewall to protect against malicious attacks during package installation.
  • Available in public preview for all GitHub Enterprise Cloud customers, including data-res…: Available in public preview for all GitHub Enterprise Cloud customers, including data-resident versions.
  • Policy controls include cooldown periods, advisory database checks, and supply-chain chec…: Policy controls include cooldown periods, advisory database checks, and supply-chain checks.

Sources checked by our analysis pipeline: 1

GitHub package firewall in public preview

An increasing number of malware attacks exploit systems at package installation time, harvesting credentials on CI/CD hosts or developer workstations without even running the package’s code. To stem this tide of attacks, GitHub is introducing a new package firewall capability. The package firewall sits between endpoints like Actions runners or coding agents and the upstream package repositories, inspecting both metadata requests and package downloads for signs of malicious activity. The package firewall is available today in public preview for all GitHub Enterprise Cloud customers, including data-resident GitHub Enterprise Cloud.

How it works

First, administrators set policy controls for their enterprise. The controls available today include a configurable cooldown period, checking the GitHub Advisory Database for malware or vulnerability alerts, and supply-chain checks like attestation downgrades.

Then endpoints like coding agents and CI/CD hosts need configuration to use the firewall for their requests instead of pointing directly at the upstream package registries. Metadata requests for package lists as well as the actual package downloads then flow through the firewall, which evaluates them against the policy. If a package is blocked erroneously, the user can request an exception with a workflow similar to other GitHub Advanced Security features.

Availability and limitations

The package firewall is available in public preview as we scale up the infrastructure behind it and continue to add features based on customer demand. It is available to GitHub Enterprise Cloud customers, including GitHub Enterprise Cloud with data residency. The service is free while in the preview period. When it reaches general availability, it will be charged based on metered usage, similar to Actions billing.

Currently the package firewall only supports npm packages.

How to use it

For detailed setup instructions, see Protecting endpoints with package firewall. Join the discussion in GitHub Community.

Original source: github.blog

Technology

More in Technology