GitHub has introduced an install-time package firewall in public preview for npm packages.
Operating between endpoints and upstream repositories, it inspects metadata and downloads to block suspicious packages, attestation downgrades, and malicious install scripts.
The new tool acts as a safety valve during the code download process, checking requests and files for suspicious activity. The feature is currently in beta and supports only software packages related to the JavaScript library ecosystem, and is available to all GitHub Enterprise Cloud customers.
According to the company, the filter sits between developers' devices or internal storage systems and public software sources. The goal is to prevent attacks that exploit the automatic installation of add-ons by automated systems or artificial intelligence tools, which often download code without direct human supervision.
System administrators can configure a number of protection rules:
- Blocking known dangerous packages based on official security warnings.
- Filtering based on the severity of problems affecting a specific release, with the default of excluding only the most serious issues.
- Blocking packages that do not have an official digital identity or that show changes compared to older versions.
- Detect and block packages that automatically add executable code during installation, as such practices can be used to steal sensitive data.
- Establish a waiting period for new package versions, preventing them from being installed immediately before a certain period of time has passed since their publication.
If a legitimate package is accidentally blocked by the system, administrators have the ability to submit an exception request to have it approved for download.
↳
READ ALSO
HACKS.GR / RELATED
Software & Open Source
New PipeWire version 1.6.11 released with audio and Bluetooth fixes
↗
The move comes as various open source platforms are adopting similar waiting policies. The introduction of these time limits adds significant difficulty to attacks where attackers release infected versions of popular packages after gaining access to developer accounts.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)