An expanding figure of malware attacks utilize systems at bundle facility time, harvesting credentials on CI/CD hosts or developer workstations without equal operating the package’s code. To stem this tide of attacks, GitHub is introducing a new bundle firewall capability. The bundle firewall sits between endpoints akin Actions runners or coding agents and the upstream bundle repositories, inspecting the two metadata requests and bundle downloads for signs of malicious activity. The bundle firewall is accessible today in community preview for all GitHub Enterprise Cloud customers, including data-resident GitHub Enterprise Cloud.
How it works
First, administrators set guideline controls for their enterprise. The controls accessible today contain a configurable cooldown period, checking the GitHub Advisory Database for malware or exposure alerts, and supply-chain checks akin attestation downgrades.
Then endpoints akin coding agents and CI/CD hosts need configuration to use the firewall for their requests alternatively of pointing immediately at the upstream bundle registries. Metadata requests for bundle lists as fine as the genuine bundle downloads afterward stream through the firewall, which evaluates them against the policy. If a bundle is blocked erroneously, the person can petition an elimination alongside a workflow akin to another GitHub Advanced Security features.
Availability and limitations
The bundle firewall is accessible in community preview as we measure up the infrastructure rearward it and continue to add features according to client demand. It is accessible to GitHub Enterprise Cloud customers, including GitHub Enterprise Cloud alongside data residency. The assistance is liberated during in the preview period. When it reaches broad availability, it volition be charged according to metered usage, akin to Actions billing.
Currently the bundle firewall lone supports npm packages.
How to use it
For detailed setup instructions, see Protecting endpoints alongside bundle firewall. Join the conversation in GitHub Community.
