GitHub puts a firewall between your CI runners and the npm registry

On October 20, 2026, GitHub opened a public preview of a firewall that sits between Actions runners, coding agents and the npm registry, inspecting metadata requests and package downloads alike. It blocks malware at install time, where scanners show up too late: turn it on if your CI installs third-party code.