On 20 October 2026 GitHub released Package Firewall in public preview. It sits between developers and public package registries and can block versions that match risk policies before they enter development or build environments.
Why it matters
Modern products depend on many third-party packages. A compromised popular package or a malicious lookalike can travel from a developer machine into a production build. This is software supply-chain risk.
What owners gain
- A checkpoint before risky packages enter a build.
- Consistent policy across repositories and teams.
- Another layer alongside dependency review and secret scanning.
What it cannot replace
It does not make every allowed package trustworthy. Teams still need lockfiles, controlled updates, code review and vulnerability scanning.