GitHub Launches npm Firewall to Block Malicious Packages Before Installation
Summary
GitHub is introducing a new package firewall feature as a preview to block the installation of suspicious npm packages. This firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate for npm packages.
IFF Assessment
FRIEND
This is good news for defenders as GitHub is proactively developing tools to prevent the installation of malicious software.
Defender Context
Defenders should be aware of this new npm firewall feature as it can help mitigate supply chain attacks by preventing malicious code from entering development environments. It's important to stay updated on its capabilities and ensure it's properly configured.