proxy

A caching proxy for package registries. Speeds up installs by caching artifacts locally, and can hide newly published versions until they’ve aged past a configurable cooldown so automated pipelines aren’t first in line for a malicious release.

brew install git-pkgs-proxy
proxy -listen :8080

Then point your package managers at it: registry=http://localhost:8080/npm/ in .npmrc, GOPROXY=http://localhost:8080/go,direct, sparse+http://localhost:8080/cargo/ in ~/.cargo/config.toml, and so on. The proxy serves an install guide at /install with the exact stanza for each ecosystem.

Cooldown

cooldown:
  default: "3d"
  ecosystems:
    npm: "7d"
  packages:
    "pkg:npm/lodash": "0"

When enabled the proxy strips versions from metadata responses until they’ve aged past the threshold. Resolution order is package PURL, then ecosystem, then global default. The implementation is the cooldown module.

Artifact scanning

Cooldown gates on age; scanning gates on content. When enabled, each artifact is staged, handed to one or more external scanners over a small HTTP contract, and only committed to the cache if none of the block-mode scanners reject it.

scanning:
  enabled: true
  scanners:
    - name: clamav
      url: http://clamav-adapter:8080/scan
      mode: block
    - name: trivy
      url: http://trivy-adapter:8081/scan
      mode: monitor

Scanners receive package metadata and a short-lived signed URL, then pull the bytes themselves; the proxy never uploads artifact content to a scanner.

Supported registries

npm, Cargo, RubyGems, Go modules, Hex, pub.dev, PyPI, Maven, Gradle build cache, NuGet, Composer, Conan, Conda, CRAN, Julia, Swift, Helm, Homebrew, OCI/Docker, Alpine APK, Debian/APT, RPM, and a generic HTTP-download endpoint for GitHub release assets and tools like mise or aqua. Cooldown is available wherever the upstream metadata exposes publish timestamps. OCI upstreams can use static credentials or ECR’s 12-hour tokens with automatic refresh.

What else it does