GitHub package firewall in public preview
GitHub announced that its package firewall is now in public preview. The changelog post, published 2026-10-20, states that the feature is aimed at malware that exploits systems at package installation time to harvest credentials on CI/CD hosts and developer workstations.
Why it matters
Malware that runs during package installation can expose credentials before any package code is executed. A package firewall offers a control point at the install stage for teams that pull dependencies in CI/CD and on developer machines.
Who should care
Engineering teams and DevOps owners running CI/CD pipelines, developers installing open-source packages, and online businesses whose build systems hold deployment credentials.
What you can do
Read the GitHub changelog post to check the preview's supported package ecosystems and configuration options, then evaluate enabling it on a non-production CI pipeline.