GitHub package firewall in public preview
- An increasing number of malware attacks exploit systems at package installation time, harvesting credentials on CI/CD hosts or developer workstations without even running the package’s code.
- To stem this tide of attacks, GitHub is introducing a new package firewall capability.
- The package firewall sits between endpoints like Actions runners or coding agents and the upstream package repositories, inspecting both metadata requests and package downloads for signs of malicious activity.
Unverified
- An increasing number of malware attacks exploit systems at package installation time, harvesting credentials on CI/CD hosts or developer workstations without even running the package’s code.
- To stem this tide of attacks, GitHub is introducing a new package firewall capability.
- The package firewall sits between endpoints like Actions runners or coding agents and the upstream package repositories, inspecting both metadata requests and package downloads for signs of malicious activity.
Sources: Github