We train AI Engineers. We deploy Enterprise AI. Join 100K+ AI practitioners at Towards AI Academy or reach out for help making your company AI native. towardsai.com
npm Installs Need a Gate. Dependabot Alerts Need a Ranking.
How GitHub package firewall blocks risky packages before runners, agents, and laptops install them, and how reachability analysis shows which alerts your code actually calls.
A malicious npm package doesn’t need your application to run it. A preinstall script is enough, and it runs on whatever machine types npm install: a CI runner, an AI coding agent, a laptop. Meanwhile, your Dependabot queue keeps growing. GitHub now has a control for each problem. Package firewall blocks risky packages before they install. Reachability analysis shows which alerts your code actually calls, so you fix those first. Here's how both work and how to roll them out.
Press enter or click to view image in full size
The two outcomes in one view: a too-new version withheld at install time, and the backlog ranked by whether your code can reach the vulnerable function.
Both features are in public preview on GitHub Enterprise Cloud, including data residency, and both are free during the preview. The firewall supports npm today; reachability supports JavaScript and TypeScript.
We train AI Engineers. We deploy Enterprise AI. Join 100K+ AI practitioners at Towards AI Academy or reach out for help making your company AI native. towardsai.com
