GitHub bundle firewall in public preview

An growing variety of malware assaults exploit techniques at bundle set up time, harvesting credentials on CI/CD hosts or developer workstations with out even operating the bundle’s code. To stem this tide of assaults, GitHub is introducing a brand new bundle firewall functionality. The bundle firewall sits between endpoints like Actions runners or coding brokers and the upstream bundle repositories, inspecting each metadata requests and bundle downloads for indicators of malicious exercise. The bundle firewall is out there at the moment in public preview for all GitHub Enterprise Cloud prospects, together with data-resident GitHub Enterprise Cloud.

First, directors set coverage controls for his or her enterprise. The controls accessible at the moment embody a configurable cooldown interval, checking the GitHub Advisory Database for malware or vulnerability alerts, and supply-chain checks like attestation downgrades.

Then endpoints like coding brokers and CI/CD hosts want configuration to make use of the firewall for his or her requests as an alternative of pointing straight on the upstream bundle registries. Metadata requests for bundle lists in addition to the precise bundle downloads then circulate by way of the firewall, which evaluates them in opposition to the coverage. If a bundle is blocked erroneously, the person can request an exception with a workflow much like different GitHub Advanced Security options.

The bundle firewall is out there in public preview as we scale up the roads behind it and proceed so as to add options primarily based on buyer demand. It is out there to GitHub Enterprise Cloud prospects, together with GitHub Enterprise Cloud with knowledge residency. The service is free whereas within the preview interval. When it reaches normal availability, it is going to be charged primarily based on metered utilization, much like Actions billing.

Currently the bundle firewall solely helps npm packages.

For detailed setup directions, see Protecting endpoints with package firewall. Join the dialogue in GitHub Community.