GitHub o'rnatish vaqti davomida shubhali npm paketlarini bloklash uchun yangi paket firewall'ini oldindan ko'rish sifatida joriy etishini e'lon qildi.
"Firewall metadata so'rovlari va paket yuklab olishlarini zararli faoliyat belgilari uchun tekshiradi va o'rnatish vaqti siyosat darvozasi sifatida ishlaydi," deb aytdi GitHub.
Hozirda faqat npm paketlarini qo'llab-quvvatlaydigan ushbu funksiya, ma'lumotlar rezidentligi bilan GitHub Enterprise Cloud mijozlarini ham o'z ichiga olgan barcha GitHub Enterprise Cloud mijozlari uchun ochiq oldindan ko'rishda mavjud.
Microsoft sho'ba korxonasiga ko'ra, firewall paketlar o'rnatilganda tizimlarni buzadigan zararli dastur hujumlarini oldini olish maqsadida oxirgi nuqtalar yoki ichki registrlar va yuqori oqim paket omborlari o'rtasida joylashtirilgan.
Bu xatti-harakat foydalanuvchilarni jiddiy xavfsizlik xatarlariga duchor qilishi mumkin, ayniqsa sun'iy intellekt (SI) agentlari va CI runnerlari o'zlarining aniq ruxsatisiz vazifani bajarish yoki qurilishni yakunlash uchun bog'liqliklarni avtomatik ravishda o'rnatganda.
G'oya shundaki, kodlash agentlari va CI/CD xostlari kabi oxirgi nuqtalar o'z so'rovlari uchun firewall'dan foydalanadi, to'g'ridan-to'g'ri ommaviy paket registrlariga murojaat qilish o'rniga. Keyin firewall paket yuklab olishlarini minimal paket yoshi va zararli dastur maslahatlari kabi siyosat nazoratlari bilan tekshiradi va ushbu siyosatlarga mos kelmaydigan yuklab olishlarni bloklaydi.
Firewall'dan foydalanish uchun administratorlar quyida keltirilgan siyosat nazoratlarini sozlashi kerak -
- Faol zararli dastur maslahatlari uchun GitHub Advisory Database'ni tekshirish orqali ma'lum zararli dasturlarni bloklash
- So'ralgan paket versiyasiga ta'sir qiladigan kamchiliklar uchun GitHub Advisory Database'ni tekshirish orqali zaifliklarning jiddiyligiga asoslanib paketlarni bloklash. Nazorat o'rnatishni bloklaydigan jiddiylik darajasi sifatida "Faqat kritik" ni standart qilib oladi, garchi foydalanuvchilar "Yuqori yoki undan yuqori", "O'rta yoki undan yuqori" yoki "Har qanday jiddiylik" ni tanlashi mumkin.
- So'ralgan paket versiyasi uchun attestatsiyalarni avvalgi versiyalar bilan solishtirish va so'ralgan versiya SLSA attestatsiyasiga ega bo'lmasa yuklab olishni to'xtatish orqali attestatsiya pasayishini bloklash
- Paket yaqinda preinstall yoki postinstall hooklari yordamida ishlaydigan skriptlarni qo'shganligini tekshirish va sezgir ma'lumotlarni o'g'irlash uchun suiiste'mol qilinishi mumkin bo'lgan yangi o'rnatish skriptlarini bloklash
Sozlangan minimal yoshdan yangi bo'lgan versiyalarni o'rnatishni oldini oladigan sovutish davriga asoslanib paketlarni bloklash. Qiymat 1 dan 365 kungacha bo'lishi mumkin. Standart qiymat 1 kun. Foydalanuvchilar uni 0 ga o'rnatish orqali o'chirib qo'yishlari mumkin.
Firewall tomonidan xato bilan bloklangan paketga kirish kerak bo'lgan foydalanuvchilar istisno so'rovini yuborishlari mumkin, bu esa korxona administratorlari va xavfsizlik menejerlari tomonidan tasdiqlanishi mumkin.
Bu rivojlanish 2026-yil 12-noyabrda chiqarilishi rejalashtirilgan Rust 1.100 xavfsizlik skanerlari va saqlovchilarga zararli crate nashrlarini foydalanuvchilar tomonidan o'rnatilishi yoki ishlatilishidan oldin belgilash va bloklash uchun vaqt beradigan sozlanadigan minimal nashr yoshini qo'llab-quvvatlashga tayyorlanayotgani bilan bir vaqtda sodir bo'lmoqda.
"cargo/config.toml" dagi "global-min-publish-age" opsiyasi orqali aniqlanadigan qiymat foydalanuvchilarga minimal nashr yoshini kunlar yoki haftalarda belgilashga imkon beradi. Agar ko'rsatilmagan bo'lsa, standart ravishda yetti kunlik kutish davri qo'llaniladi va bu oyna ichida nashr etilgan nashrlarni o'tkazib yuboradi.
O'tgan yil davomida ochiq manba ekotizimlarida, jumladan npm, Python, Microsoft Visual Studio Code, Ruby, Bun, pnpm va Yarn'da shunga o'xshash kutish davrlari joriy etildi, bu yangi nashr etilgan, tekshirilmagan versiya darhol qurilishga tortilishini kamaytirish orqali dasturiy ta'minot ta'minot zanjiri xavfsizligini mustahkamlash usuli sifatida.
Sovutish davrlari yomon niyatli shaxs mashhur paketning zaharlangan versiyasini saqlovchi hisobni egallab olgandan so'ng nashr etadigan hujumlarda ishqalanish qo'shish va sekinlashtirishga yordam beradi, shu bilan qo'lda yoki avtomatik o'rnatishlar orqali tez tarqalishni oldini oladi.
"Murosa shundaki, qonuniy tuzatishlar ham kutishi kerak, agar ishlab chiquvchilar istisno qilmasa," dedi Socket. "Zararli kod ham yosh bilan sehrli ravishda zararsiz bo'lib qolmaydi. Aniqlashdan qochgan nashr shunchaki sovutish davridan o'tib ketishi mumkin. Qiymat tadqiqotchilar, saqlovchilar va registrlarga keyingi bog'liqlik yangilanishi hujumni yanada tarqatishdan oldin harakat qilish uchun vaqt sotib olishda."
GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time.
"The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitHub said.
The feature, which currently supports only npm packages, is available in public preview for all GitHub Enterprise Cloud customers, including data-resident GitHub Enterprise Cloud.
According to the Microsoft subsidiary, the firewall is placed between endpoints or internal registries and the upstream package repositories so as to deter malware attacks that compromise systems when packages are installed.
This behavior can expose users to severe security risks, especially when artificial intelligence (AI) agents and CI runners automatically install dependencies to complete a task or build without their explicit permission.
The idea is that endpoints like coding agents and CI/CD hosts use the firewall for their requests instead of directly pointing to the public package registries. The firewall then checks package downloads against policy controls such as minimum package age and malware advisories, and blocks downloads that do not meet those policies.
To use the firewall, administrators are required to configure policy controls, such as the ones listed below -
- Block known malware by checking against the GitHub Advisory Database for active malware advisories
- Block packages based on the severity of vulnerabilities by checking the GitHub Advisory Database for flaws that affect the requested package version. The control defaults to "Critical only" as the severity level that blocks an installation, although users can choose "High or higher," "Medium or higher," or "Any severity."
- Block attestation downgrades by comparing attestations for the requested package version with those of earlier versions and stop the download if the requested version does not have an SLSA attestation.
- Block newly-introduced install scripts by checking whether the package recently added scripts that run using preinstall or postinstall hooks, which can be abused to steal sensitive data.
Block packages based on a cooldown period that prevents versions that are newer than the configured minimum age from being installed. The value can range from 1 to 365 days. The default value is 1 day. Users can disable it by setting it to 0.
Users who need access to a package that gets blocked erroneously by the firewall can submit an exception request, which can then be approved by enterprise administrators and security managers.
The development comes as Rust 1.100, which is scheduled for release on November 12, 2026, readies to add support for a configurable minimum publish age, allowing security scanners and maintainers time to flag and block malicious crate releases before they can be installed or used by users.
The value, defined via the "global-min-publish-age" option in "cargo/config.toml," allows users to specify a minimum publication age in days or weeks. If left unspecified, a seven-day waiting period is applied by default to skip releases published within that window.
Over the past year, similar waiting periods have been implemented across open-source ecosystems, including npm, Python, Microsoft Visual Studio Code, Ruby, Bun, pnpm, and Yarn, as a way to bolster software supply chain security by reducing the chance that a newly published, unreviewed version is immediately pulled into a build.
Cooldown periods help add friction and slow down attacks in which a bad actor publishes a poisoned version of a popular package after seizing control of a maintainer account, thereby preventing rapid spread through manual or automated installations.
"The tradeoff is that legitimate fixes have to wait, too, unless developers make an exception," Socket said. "Malicious code also doesn't magically become harmless with age. A release that escapes detection can simply outlast the cooldown. The value is in buying researchers, maintainers, and registries time to act before the next dependency update carries an attack further."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
