Malware that strikes before you even run the code
On Tuesday, October 20, 2026, GitHub announced that its new package firewall is now in public preview for all GitHub Enterprise Cloud customers. The feature sits between your code endpoints — CI/CD runners and AI coding agents — and public package registries, inspecting npm installs for signs of malware before they reach your machines. For small dev teams and agencies, it targets the exact attack that keeps security people up at night: a poisoned package that harvests your cloud credentials at install time, without ever executing its payload.
What happened
According to GitHub’s official changelog, published October 20, 2026:
- The threat. An increasing number of malware attacks exploit systems at package installation time, harvesting credentials on CI/CD hosts or developer workstations without even running the package’s code.
- How it works. The firewall sits between endpoints like Actions runners or coding agents and the upstream package repositories. It inspects both metadata requests and package downloads for signs of malicious activity, evaluating each against the enterprise’s policy.
- Policy controls. Administrators set the rules for their enterprise. Available controls today include a configurable cooldown period (which delays new package versions so fast-moving malware gets caught first), checks against the GitHub Advisory Database for malware or vulnerability alerts, and supply-chain checks such as attestation downgrades.
- Endpoint setup. Coding agents and CI/CD hosts are configured to route their requests through the firewall instead of pointing directly at upstream registries. If a legitimate package gets blocked by mistake, users can request an exception through a workflow similar to other GitHub Advanced Security features.
- Pricing. The service is free during the public preview. When it reaches general availability, it will be billed on metered usage, similar to how GitHub Actions is billed.
- Scope today. The package firewall currently supports npm packages only. It is available to GitHub Enterprise Cloud customers, including GitHub Enterprise Cloud with data residency, while GitHub scales the infrastructure behind it.
Independent coverage confirms the timing: the announcement appeared in October 20 tech news roundups (including the Front Page AI news briefing), and it lands in a busy month for GitHub supply-chain security — workflow lockfiles for Actions entered public preview on October 14, and Dependabot expanded package-manager support days earlier. The backdrop is a real and growing volume of attacks: Help Net Security reported GitHub’s Advisory Database logged more than 6,500 npm malware advisories in the year ending May 2026, roughly 18 malicious packages a day.
Why it matters for your small business
This is not a story only for enterprises with a SOC team. If anything, small teams are the most exposed:
- AI coding agents install packages autonomously. Tools like Claude Code, GitHub Copilot and Codex routinely add dependencies on your behalf. A poisoned package pulled by an agent on a maintainer’s laptop or a CI runner can push malicious code or exfiltrate secrets before anyone notices — the exact scenario security researchers warned about after the npm trusted-publishing flaw this month.
- Your CI runner is a credential vault. Small agencies and SaaS teams park AWS keys, Stripe secrets and API tokens in Actions runners. Install-time malware doesn’t need to run — it just reads the environment at install. A firewall that scans before the download lands is the cheapest place to break that chain.
- Free guardrails beat policies you never enforce. Most small teams know they should pin dependencies, review updates and scope tokens — and most don’t, because shipping comes first. A cooldown period that keeps you out of the opening hours of a fast-moving attack is automated hygiene: it protects you while you get around to the rest.
- The gap to watch. npm only, and Enterprise Cloud only, means freelancers and small teams on free or Team plans can’t use it yet — and non-npm ecosystems (PyPI, Composer, Go modules) are still unprotected by this particular control. Treat it as one layer, not the whole strategy.
Pricing, availability, and what to do next
- Availability: Public preview now, for all GitHub Enterprise Cloud customers, including data-resident deployments.
- Price: Free during the preview period; metered billing (like GitHub Actions) at general availability. No pricing figures announced yet.
- Scope: npm packages only, for now.
- What to do: If your team is on Enterprise Cloud, ask your admin to enable the package firewall policy controls — start with a cooldown period and Advisory Database checks — and point your Actions runners and coding-agent endpoints through it instead of directly at the npm registry. If a build breaks on a blocked package, use the exception workflow rather than disabling the control.
Frequently asked questions
Is the GitHub package firewall free?
Yes, during the public preview it is free. GitHub says it will be charged on metered usage, similar to Actions billing, once it reaches general availability.
Does it work with PyPI, Composer, or other registries?
Not yet. The firewall currently supports npm packages only. GitHub says it is adding features based on customer demand as it scales the preview.
Do I need GitHub Enterprise Cloud to use it?
Yes. The public preview is available to GitHub Enterprise Cloud customers, including those with data residency. There is no announced timeline for free or Team plans.
Will it block legitimate packages?
False positives are possible with any scanning control. GitHub provides an exception-request workflow similar to its other Advanced Security features, so a wrongly blocked package can be unblocked without turning the firewall off.
Sources
- GitHub Changelog, “GitHub package firewall in public preview,” October 20, 2026: github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview
- Front Page AI news roundup, October 20, 2026, covering the announcement: youtube.com/watch?v=2uWrgT9F_sE
- Background: Help Net Security on GitHub’s cooldown controls and npm malware volume (6,500+ advisories in the year ending May 2026): helpnetsecurity.com/2026/07/27/github-dependabot-cooldown
