← All stories

AI security

GitHub's npm package firewall can block brand-new versions before they install

By Help Net Security1 min read

GitHub has announced a package firewall for npm that checks packages against an enterprise's policy before they install, blocking known malware, critical vulnerabilities and brand-new versions, Help Net Security reported. The checks run before a package reaches a developer's laptop, a build or a coding agent.

Cover for a ai-security story

GitHub has announced a package firewall for npm that checks packages against an enterprise's policy before they are installed, Help Net Security reported.

According to the report, the firewall can block known malware, packages carrying critical vulnerabilities, and brand-new package versions. The checks run upstream, before a package reaches a developer's laptop, a build system, or a coding agent. Any developer can turn the feature on simply by pointing their npm client at the firewall, the report said.

GitHub framed the launch against the rapid growth of AI-assisted software development. The company said AI agents are helping developers build more software, faster, and described the firewall as one of four security additions aimed at that shift, according to Help Net Security. The report excerpt did not detail the other three additions.

The ability to block brand-new versions is notable for supply chain defense. Requiring freshly published releases to clear policy checks before installation addresses a common attack pattern in which malicious code is uploaded to a public registry and pulled into projects before defenders can identify it. As AI coding agents increasingly fetch dependencies autonomously, moving these checks to a point before any package reaches a machine or build pipeline reduces the window in which a compromised release can execute.

Details in this report come from Help Net Security's coverage of GitHub's announcement.

Source: Help Net Security

Cover for a ai-security story

AI security

Apple Adds Setting to Exclude Apps from Siri AI, EFF Says

Apple's latest device update, iOS 27.2, introduces a setting that lets users exclude apps from Siri AI features, according to the Electronic Frontier Foundation, which says the change addresses a request from its Encrypt It Already campaign.

1 min read

AI-written summary Source: EFF Updates · Fetched

Cover for a ai-security story

AI security

Unit 42 Warns of Peak Season Cyber Threats Targeting Retailers

Unit 42 has outlined the key cyber threats facing retailers during the peak shopping season, ranging from ransomware to attacks involving artificial intelligence, along with guidance on defending operations and customer trust.

1 min read

AI-written summary Source: Unit 42 · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.