GitHub launched a package firewall in public preview for GitHub Enterprise Cloud, including data-resident tenants. For now it only covers npm.
How it works
You point coding agents, CI runners and dev machines at the firewall instead of the public registry. It inspects metadata requests and downloads and enforces policy, like minimum package age and malware advisories, before anything installs. GitHub calls it out for AI agents and CI hosts that pull dependencies without anyone watching.
My take
After the npm worms this month, an install-time gate makes a lot of sense. It’s Enterprise only for now. At home, you can get part of the way with a minimum-age rule and a lockfile, and by not letting agents run npm install without asking.
God Bless, and Happy hacking!
