GitHub has introduced a new security measure designed to enhance the safety of npm package installations. The npm firewall, now available in public preview for GitHub Enterprise Cloud customers, acts as a barrier against potentially harmful packages.
How the npm Firewall Works
The npm firewall scrutinizes both metadata and package downloads during the installation process to identify any signs of malicious activity. It serves as a policy gate at the installation stage, ensuring that only safe packages are installed. This tool is strategically positioned between endpoints or internal registries and the upstream repositories to thwart malware attacks that might exploit package installations.
The primary users of this firewall include coding agents and CI/CD hosts, which direct their package requests through the firewall instead of accessing public package registries directly. The firewall evaluates each package download against established policy controls, such as minimum package age and malware advisories, blocking those that fail to comply.
Configuring Policy Controls
Administrators are responsible for setting up the necessary policy controls to maximize the firewall’s effectiveness. These controls include blocking known malware by consulting the GitHub Advisory Database and preventing packages with critical vulnerabilities from being installed.
Additional policies involve blocking attestation downgrades by comparing attestations of the requested package version with older versions and stopping downloads lacking proper Software Level of Security Attestation (SLSA). The firewall also checks for newly introduced install scripts that could be misused for data theft.
Cooldown Periods and Industry Trends
A significant feature of this firewall is the cooldown period, which restricts the installation of packages that are newer than a configured minimum age, typically set to one day by default. However, this can be adjusted up to 365 days or disabled entirely if needed.
Rust is set to introduce a similar feature with its upcoming version 1.100, allowing users to configure a minimum publish age, giving security teams the necessary time to review and block malicious releases. This trend of implementing waiting periods is gaining traction across various open-source ecosystems like npm, Python, and others to strengthen software supply chain security.
While cooldown periods add a layer of security, they also delay legitimate updates unless exceptions are made. This trade-off provides researchers and maintainers crucial time to act against potential threats before they proliferate.
