diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 54eda7d..a6a866f 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -108,6 +108,12 @@ jobs:
           registry-url: ${{ inputs.registry }}
           scope: ${{ inputs.scope }}
 
+      - name: Enable Socket Firewall
+        uses: SocketDev/action@be1f253a41351d59095f8d7f1425985097dd1054
+        with:
+          mode: firewall-free
+          shims: true
+
       - name: Ensure npm version
         if: ${{ !inputs.dry-run }}
         run: |
diff --git a/publish-npm/README.md b/publish-npm/README.md
index 9663f9b..8adb335 100644
--- a/publish-npm/README.md
+++ b/publish-npm/README.md
@@ -8,6 +8,7 @@ for the package scope, Node.js version, registry URL, and other options. The wor
 - **Downloads Artifacts**: Downloads specified artifacts if needed. 📦
 - **Checks Out Your Repository**: Retrieves your code. 📥
 - **Sets Up Node.js**: Installs the specified Node.js version and configures the `.npmrc` file. ⚙️
+- **Enables Socket Firewall**: Blocks installation of any package on npmjs.com confirmed as malware by Socket, for every subsequent npm/yarn/pnpm call in the job. 🛡️
 - **Installs Dependencies**: Uses the specified install command (default: `npm ci`) to install the dependencies. 📦
 - **Builds the Package**: Builds the package using the specified build command (default: `npm run build`). 🔨
 - **Performs Type Checking**: Runs type checking if configured. 🔍