Protecting endpoints from malware with package firewall

[ahpook]

🏷️ Discussion Type

Product Feedback

💬 Feature/Topic Area

Supply chain security

Discussion Details

We've just launched a new package firewall capability in public preview and would love to hear your feedback. Docs are here: https://docs.github.com/enterprise-cloud@latest/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/protecting-endpoints-with-package-firewall

[ebickle]

This is an exciting new feature! We're currently testing it out, but already have some early feedback.

When minimum package age is enabled, we'd like the latest dist-tag (or potentially all dist-tags) to be re-mapped to the latest package that meets the minimum package age rule.

For example, if I type npm install undici I currently get:

npm notice undici: 6 versions blocked by package-firewall due to security policies (version cooldown). Request an override: https://github.com/enterprises//security/bypass-requests/package-firewall/new?ecosystem=npm&package=undici
npm error code ETARGET
npm error notarget No matching version found for undici@8.12.3.
npm error notarget In most cases you or one of your dependencies are requesting a package version that doesn't exist.

The latest version of undici (8.12.3) was published today and I'm testing with a 7 day cooldown period. In this scenario, instead of having latest point to the blocked 8.12.3, it would be a better user experience to point to 8.11.2. Obviously this would be a non-trivial algorithm; it would need to be semver aware as many packages maintain multiple major versions in parallel.

Without the dynamic dist-tag rewriting, we'd expect a very large number of override requests as developers type npm install for frequently updated packages they're adding for the first time.

[hfhbd]

Any chance to not use a PAT but a Fine-grained token?

[ahpook]

Yes, you can use a fine-grained PAT, it just needs to have Public / Read access to repos. I'll update the docs to be more clear about that.

[BenkhiraAhmedBaderEddine1]

i will try it and thanks for it

[ebickle]

Is there any way to combine the package firewall with GitHub Packages? We have a large number of internal-scoped NPM packages within the enterprise.

[ahpook]

It's a good question. Right now it's an either/or because we don't have configurable upstreams for the package firewall, it just pulls from npmjs.org. We do expect to add that kind of configuration as we head toward GA.

[ebickle]

Perfect, thanks!

At least with GitHub packages, what would help is to be able to configure specific scopes (i.e. our GitHub orgs) to route the upstream to GitHub packages and pass along the same token. That way the same GITHUB_TOKEN / PAT / etc can perform double duty - both the GitHub Packages auth and the package firewall auth.