a private NuGet feed that remembers
One dotnet nuget add source and .NET builds flow through
gastropod: a caching proxy for nuget.org, a private feed for internal packages resolved
through a single source in the right order, and a record of every restore, attributed to
whoever ran it.
connect in one line
dotnet nuget add source https://gastropod.io/nuget/ -n gastropod -u USER -p TOKEN
dotnet restore, Visual Studio, and CI work unchanged.
what happens on every restore
- Identity is fixed. The package resolves to an exact PURL, version, and sha256 digest, not just an ID from whichever source answered first.
- Integrity is checked at intake against the package's published digest, before it's served.
- Advisories are correlated. Known OSV advisories attach to the exact version and map across everything downstream.
- The restore is recorded. Which principal pulled which package, when, and from where, on the audit spine and exportable.
- It's remembered. SBOM, findings, and where-seen history stay on the digest for every later restore.
the dependency-confusion problem
The dependency-confusion research that made headlines in 2021 walked into major software companies through exactly this door: internal package names, a public feed, and a resolver willing to take the higher version from whichever source offered it. .NET teams live with the mitigation to this day: package source mapping, source ordering rules, prefix reservations, all attempts to make multiple feeds behave like one trustworthy feed. Gastropod's answer is to actually be one feed. Private packages and the nuget.org proxy resolve through a single source URL, private names first, so a public lookalike can't outbid an internal package and there's no source-ordering setting to misconfigure per machine. Identity mismatches are flagged at intake, block rules can quarantine a suspect package before any project restores it, and if something got through upstream, where-seen history shows every solution that pulled it.
proxy, hosted, virtual
proxy
A caching mirror of nuget.org. The first restore fetches and verifies into content-addressed, deduplicated storage.
hosted
Internal packages, pushed with standard
dotnet nuget push, private by default with reader and publisher roles.
virtual
One source URL aggregating both, private-first.
Every feature is on every tier: OIDC SSO, scoped tokens, SBOMs, blast radius, and audit are all present starting at our published rates.
FAQ
how do I add gastropod as a NuGet source?
Use dotnet nuget add source with the gastropod URL and an API
token, or the equivalent nuget.config entry. Visual Studio and CI pick it up
like any other feed.
can it replace multiple feeds and source mapping?
That's the point. Private packages and the nuget.org proxy resolve through one source, private names first, so the source-ordering and mapping configuration that dependency confusion forced on .NET teams stops being something every machine can get wrong.
can I publish internal NuGet packages?
Yes. Standard dotnet nuget push to a hosted repository,
private by default, with reader and publisher roles enforced per token.
does gastropod check package integrity?
Packages are verified at intake against their published digest, and identity is pinned to that digest, so a substituted package can't inherit another package's record.
can it run alongside our current feed (Azure Artifacts, BaGet, ProGet)?
Yes. NuGet handles multiple sources natively, so gastropod can serve one project or team during evaluation while the existing feed keeps serving the rest.
Part of the full product overview. Also speaking: npm · Maven.
NuGet and .NET are trademarks of Microsoft Corporation. Gastropod is not affiliated with Microsoft. Details current as of July 2026.