#package-security
Tagged “package-security”
3 articlesGitHub's package firewall puts a policy check between your runners and npm
GitHub has opened a package firewall in public preview for Enterprise Cloud customers. It sits between endpoints and upstream registries and checks npm metadata requests and downloads against enterprise policy before anything installs.
Oct 22, 2026 · Priya NairSecurity & supply chainGitLab's Dependency Firewall moves package policy in front of the build
GitLab has put Dependency Firewall into early access, a policy layer that blocks malicious, vulnerable or non-compliant packages before they reach a build. It shifts dependency checks from after install to before it, which is where credential-stealing packages do their damage.
Oct 15, 2026 · Maya OkonkwoSecurity & supply chainPyPI stops accepting late file uploads to releases older than 14 days
PyPI will no longer accept new files uploaded to a release once that release is more than 14 days old, closing a stealth path a compromised publishing token could otherwise use to graft malicious code onto an established package. PyPI has said it is not yet aware of the technique being used in a real attack.
Jul 28, 2026 · Maya Okonkwo