Guide · Supply-chain security · as of 29 October 2026
GitHub’s package firewall is for GitHub Enterprise Cloud customers, and only for npm. If you are not on that plan, or you ship more than JavaScript, there are good alternatives, including free and open-source ones. Here is how the main install-time firewalls compare, and where each one fits.
GitHub package firewall
A managed proxy with enterprise policy: cooldowns, Advisory Database checks and attestation-downgrade detection, with an exception workflow for false positives. npm only, GitHub Enterprise Cloud only, free in preview and metered at general availability.
Socket Firewall Free
A free command-line tool, sfw, that needs no API key. You prefix your install (sfw npm install, sfw pip install) and it filters the network traffic, blocking confirmed malware. It covers npm, yarn and pnpm, plus pip, uv and cargo. The free tier works with public registries only and blocks only human-verified malware, warning rather than blocking on AI-only detections. Private registries, allow-lists and configurable policy are in the paid Enterprise tier.
Aikido Safe Chain
An open-source install-time firewall for npm, yarn and pnpm, and several Python tools, that checks every install against Aikido’s threat intelligence before the download finishes, with a cooldown on brand-new versions. A good fit if you want the code in the open and nothing to pay.
Datadog Supply-Chain Firewall
An open-source tool (DataDog/supply-chain-firewall, “SCFW”) that prevents the installation of malicious npm and PyPI packages. It wraps your install command and is yours to run and audit, which suits a team that wants to self-host across JavaScript and Python.
No vendor at all
A different category
Snyk, Endor Labs and Google’s OSV-Scanner are worth having, but they are not install-time firewalls. They report known vulnerabilities and, in some cases, whether your code actually reaches them. Use one of them to understand your dependencies, and a firewall above to stop a malicious one arriving in the first place.
Which to pick
Sources
A question?
Tell us your stack and your plan, and we will tell you which of these actually helps.