GitHub opened Package Firewall as a free public preview for Enterprise Cloud, including data-residency deployments. It proxies npm metadata and downloads for Actions, coding agents and developer machines, then applies cooldown, advisory and attestation-downgrade policies. GitHub says GA use will be metered like Actions; other ecosystems are not yet covered.
GitHub opens Package Firewall for npm supply-chain controls
2026-10-21Verified announcementTRIAL
GitHub opened Package Firewall as a free public preview for Enterprise Cloud, including data-residency deployments. It proxies npm metadata and downloads for Actions, coding agents and developer machines, then applies cooldown, advisory and attestation-downgrade policies. GitHub says GA use will be metered like Actions; other ecosystems are not yet covered.
What this means for you
For teams running agents and CI, Package Firewall moves dependency checks into a shared organization-level proxy. Public preview status, npm-only coverage and future metering make a bounded workflow test more appropriate than broad adoption.
Evidence & related material
Technical details & scores
| Stage | public preview; free during preview; GA metering planned like Actions |
|---|---|
| Coverage | npm metadata and downloads for Actions, coding agents and developer machines |
| Policies | cooldown, GitHub Advisory Database malware/vulnerability, attestation downgrade |
| Time Basis | GitHub RSS timestamp 2026-10-20T16:11:53Z |
Technical impact 4
Engineering value 5
Adoption signal 2
Maturity 3
Verification cost 2
Risk 3