GitHub says agents and CI runners are especially exposed to install-time malware because they pull dependencies with no human in the loop. The firewall sits between endpoints or internal registries and the upstream registry and checks both metadata requests and downloads against enterprise policy.

• Controls today: a configurable cooldown (minimum package age), blocking versions with malware or vulnerability advisories in the GitHub Advisory Database, and supply-chain checks such as attestation downgrades. Wrongly blocked packages go through an exception request.
• Availability: GitHub Enterprise Cloud, including data residency. Free during preview, metered like Actions at GA. npm only for now.

Take: a minimum-age cooldown is a cheap guard against freshly hijacked versions. If you are not on Enterprise Cloud, the same idea works with an internal proxy registry and your package manager's minimum-age setting. Point agent sandboxes at it, not at the public registry.