GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall.
The checks run before a package reaches a laptop, a build, or a coding agent. GitHub says AI agents are helping developers build more software, faster, and the firewall is one of four security additions aimed at catching problems earlier.
What counts as new
The firewall’s rule on brand-new versions depends on when a release is dated.
“We rely on the package meta for release dates which is part of the package managers responsibility. We allow users to modify and can create custom policies which includes soak time/cool down period,” a GitHub spokesperson told Help Net Security when asked how the firewall decides a version is new and whether an enterprise can set its own delay.
Scanning and fixes
The other three additions work on code and alerts. AI Scan checks every pull request for vulnerabilities in languages that rule-based scanning doesn’t cover, including PHP, Shell, and COBOL. It can also scan a repository on demand, which reaches code that has already merged.
A GitHub Security extension for the Copilot app looks at a developer’s changes before a pull request exists. Paired with GitHub Code Security, it pulls the repository’s code scanning alerts into the app, AI Scan findings included, so a developer can fix them without switching tools.
“For Autofix, we provide both fix suggestions in the PR which developers can review and merge straight away, and the ability to batch remediation with Agentic Autofix. Agentic Autofix can remediate alerts across all GitHub tools, including AI Scanning, and more than 70 partner tools as well,” the GitHub spokesperson explained.
Fewer alerts to sort
Dependabot alerts flag vulnerable packages, but a package in the dependency tree is not always a package the code uses. Reachability analysis checks whether a team’s code calls the vulnerable function. Teams can inspect the call path in GitHub and rank alerts by it.
Must read:
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
