TLDR Tech / InfoSec
git-pkgs proxy
A caching proxy that sits in front of npm, PyPI, crates.io, RubyGems, and 20+ other registries, its standout feature being a configurable version cooldown that strips newly published versions from metadata responses until they age past a threshold, directly countering the speed-based supply chain attacks that consume malicious releases within minutes of publication. The cooldown resolves per-package, per-ecosystem, or globally, and pairs with an enrichment API that surfaces OSV vulnerability data, outdated-version checks, and license categorization, though cooldown only works for the 13 registries that expose publish timestamps and Hex support requires disabling signature verification.
Read the full story