GitHub package firewall: npm cooldown gate for CI and agents

The week LiteLLM shipped a backdoored release through its own pipeline, GitHub put a gate in front of the registry. On October 20 GitHub launched the package firewall in public preview: a proxy between your machines and npm that checks every package before it installs. It is the first install-time control from a major platform that treats coding agents and CI hosts as the clients most in need of one.

What actually happened

Per the GitHub changelog, the firewall inspects both metadata requests and package downloads against an enterprise policy. Three controls ship in the preview:

• Cooldown. Block any version younger than a set age. The setup docs allow 1 to 365 days, default 1, or 0 to turn it off.
• Advisory checks. Block versions flagged for malware or vulnerabilities in the GitHub Advisory Database.
• Supply-chain checks, such as attestation downgrades.

A blocked install returns an error with a link to request an exception. Setup is two lines in .npmrc: point registry at package-firewall.githubapp.com/npm/enterprises/<your-slug> and pass a GITHUB_TOKEN from an enterprise member. The token needs no elevated permissions. Artifactory can sit in front of it, but that support is experimental.

The limits matter. It is npm only. It is GitHub Enterprise Cloud only. It is free during the preview, and GitHub says it will be billed on metered usage "similar to Actions billing" at GA, with no rates published.

Why it matters for your business

A cooldown would have stopped most of this year's worst installs. Malicious releases tend to get pulled within hours. A one-day minimum age means your CI never sees them. You do not need GitHub for this idea; you need it somewhere.

Your agents install packages faster than you review them. Claude Code, Codex and Copilot all run npm install on their own. The firewall is a control that sits outside the model, which is where controls belong. An agent cannot talk its way past a 403.

Check the plan before you plan around it. Most small teams are on GitHub Team or Free, not Enterprise Cloud. If that is you, get the same effect with npm's own tooling: pin with a lockfile, run npm ci in CI, and add a minimum-release-age rule in your package manager or private registry. Python is not covered at all yet.

Budget for the meter. Metered billing on every install is a new line item. Count your CI runs now so the GA price does not surprise you.

Sources: GitHub Changelog, GitHub Docs.