The facts

  1. The service sits between development environments or internal package registries and upstream registries, checking package metadata and downloads against an organization’s rules. [1]

  2. Administrators can use malware and vulnerability intelligence, a waiting period for newly released packages and attestation-related controls. Users can request exceptions to blocked packages. [1]

  3. GitHub says the preview is free and general availability will use metered billing. The checked announcement does not provide a general-availability date or final prices. [1][2]

Still unconfirmed

  • The preview does not establish protection against every malicious dependency or support for package ecosystems beyond npm.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 22:07 UTC.

  1. GitHub Package Firewall in public preview

    GitHub · Primary source · 20 Oct 2026

    Actual launch announcement read, including its 21 October editorial clarification, enterprise eligibility and billing distinction.

  2. GitHub launches npm firewall

    The Hacker News · Reporting · 29 Oct 2026

    Independent report read. Its later report date is not used as the product’s launch date.

Report a factual error