a private PyPI server that remembers
Point pip at gastropod and get a private Python package index, a caching mirror of PyPI, and a home for your internal packages, plus the part index servers leave out: verified integrity at intake, advisories pinned to exact versions, and a record of who installed what.
connect in one line
pip install --index-url https://you:TOKEN@gastropod.io/pypi/simple/ <pkg> # or set index-url once in pip.conf
That's the integration. pip, and tools that speak its simple-index protocol, keep working unchanged.
what happens on every install
- Identity is fixed. The distribution resolves to an exact PURL, version, and sha256 digest, not just a name from whichever index answered first.
- Integrity is checked at intake, against the index's published hashes, before the file is served.
- Advisories are correlated. Known OSV advisories, and Python is a first-class OSV citizen, attach to the exact version, along with everything downstream of it.
- The install is recorded. Who pulled it, when, and from where, attributed on the audit spine and exportable.
- It's remembered. SBOM, findings, and dependents stay on the digest; the next install anywhere in your organization inherits all of it.
the problem is names, not exploits
PyPI's recurring failure mode isn't sophisticated exploits, it's names:
typosquats one keystroke from the real thing (colourama for
colorama), hijacked releases of abandoned packages (the ctx
incident), lookalikes uploaded by the thousand and installed by autocomplete. The index will
serve them; nothing in pip install asks whether this is the artifact you meant.
Gastropod asks: identity is fixed to the exact digest at intake, a mismatch between an
artifact and its claimed identity gets flagged, and block rules can quarantine a package
before a single environment installs it. If something slipped through upstream, the
where-seen history and blast-radius graph show which services have it, in minutes. Internal
package names resolve from hosted repos through the same index URL, which closes the
dependency-confusion path where a public lookalike shadows an internal name.
proxy, hosted, virtual
proxy
A caching mirror of PyPI. The first pull fetches and verifies; repeat pulls of the same digest serve from content-addressed, deduplicated storage.
hosted
Your internal packages, token-gated with reader and publisher roles.
virtual
One index URL aggregating both, resolving private names first.
Every feature is on every tier: OIDC SSO, scoped tokens, SBOMs, blast radius, and audit are all present starting at our published rates.
FAQ
how do I point pip at a private index?
Pass --index-url https://you:TOKEN@your-instance/pypi/simple/
or set index-url once in pip.conf. Everything that speaks pip's
simple-index protocol follows along.
can I host internal Python packages?
Yes. A hosted repository takes internal distributions, keeps them private by default, and serves them through the same index URL as the PyPI mirror, so private names can't be shadowed by public lookalikes.
does gastropod protect against typosquatting and hijacked packages?
It verifies identity at intake and flags artifacts whose contents don't match their claimed identity; block rules can quarantine suspect packages before any environment installs them. For anything that got through upstream, where-seen history shows every place it landed.
does it scan Python packages?
It verifies and correlates: integrity checks at intake, OSV advisories pinned to exact versions, and findings from scanners you already run — Trivy, Grype, Snyk, Anchore — attached to the artifact so they follow it everywhere.
can it mirror PyPI for CI speed and reliability?
Yes, that's the proxy mode's default behavior. The first fetch verifies and caches; later fetches serve locally, so builds stop depending on upstream latency or availability.
Part of the full product overview. Also speaking: npm · OCI · RubyGems.
"Python" and "PyPI" are trademarks of the Python Software Foundation. Gastropod is not affiliated with the PSF. Details current as of July 2026.