GITHUB PACKAGE FIREWALL IN PUBLIC PREVIEW

Summary from the TLDR InfoSec newsletter

GitHub launched a package firewall in public preview for GitHub Enterprise Cloud, including data-resident deployments. It sits between coding agents, CI/CD hosts, and upstream registries, inspecting npm metadata requests and package downloads. Administrators can set cooldown periods, check GitHub Advisory Database advisories, and block attestation downgrades. Blocked packages can receive exceptions through a request workflow. The preview is free - general availability will use metered billing.