GitHub previews an npm firewall for runners and coding agents
GitHub put Package Firewall into public preview for GitHub Enterprise Cloud. The proxy sits between development endpoints—including Actions runners and coding agents—and npm, applying cooldown, advisory, malware, vulnerability and attestation checks before allowing a package download, with an exception workflow for blocked versions.
Why it matters: The preview moves dependency controls into the network path used by autonomous coding and CI systems, where a model or workflow can otherwise fetch a newly published or compromised package without a human noticing.