GitHub package firewall in public preview
Summary
GitHub announces a public preview of a package firewall that sits between CI/CD endpoints (such as Actions runners) and upstream package registries to inspect metadata requests and downloads for signs of malicious activity. It enforces policy controls, checks the GitHub Advisory Database for malware and vulnerability alerts, and supports supply-chain checks like attestation downgrades. The feature currently supports npm packages, is free during the preview for GitHub Enterprise Cloud customers, and will be charged by metered usage after general availability.