The Product

Gastropod gives you one address to point every package manager at, in place of the registry URLs you use today, and attaches identity, provenance, advisories, an SBOM, and a full audit trail to each artifact. Point your existing clients at it; there is nothing new to learn.

See it in action

Real screens from the registry: the whole supply chain at a glance, a malicious npm package caught at intake, and exactly where it is being used.

Dashboard: inventory & findings at a glance

Caught: a malicious npm package & its blast radius

Audit: who pulled what, when, and from where

The Gastropod dashboard: counts for packages, versions, artifacts, pulls, consumers and repositories; a security band flagging advisories, identity and provenance mismatches, and verified/attested artifacts; plus pulls-over-time and most-pulled-packages charts. — One view: inventory, advisories, identity and provenance flags, verified and attested counts, and pull volume.

The package page for the npm package event-stream, flagged with an identity mismatch: it declares itself as a different name than it was served under. The page shows its transitive dependents (the org's own services that pulled it) as the blast radius, and the full list of consumers, each with a one-click CycloneDX SBOM. — A malicious npm package, caught: Gastropod flags `event-stream` on an **identity mismatch** (it declares a different name than it was served under), showing the blast radius (the services that pulled it) and every consumer, each with a CycloneDX SBOM.

The audit log: a stream of per-pull events, each with a timestamp, the package PURL (including the flagged event-stream and crossenv packages), who pulled it, the client, the source IP, and the HTTP status. — The audit spine: Gastropod records who did every pull, including what they pulled, from where, and when.

Every ecosystem, one registry

Gastropod hosts or proxies Go modules, npm, Debian/Ubuntu, OCI containers, Python (PyPI), Maven & Gradle, Alpine (apk), RHEL family (rpm), .NET (NuGet), Ruby (RubyGems), and Helm charts, plus on-demand source proxies for GitHub and GitLab. Set one variable, and your toolchain works without further changes.

Go modules

GOPROXY=…/go

npm

registry=…/npm/

Debian / Ubuntu

deb …/deb/<distro>

OCI containers

docker pull …/<repo>

Python (PyPI)

--index-url …/pypi/

Maven & Gradle

repository …/maven/

Alpine (apk)

…/apk/<repo>

RHEL family (rpm)

baseurl=…/rpm/

.NET (NuGet)

nuget source …/nuget/

Ruby (RubyGems)

mirror …/gem

Helm charts

helm pull oci://…/<chart>

…more coming soon.

Connect in one line

Point your existing clients at Gastropod; it requires no new tooling. Replace TOKEN with the value shown when you issue one; <org>/<repo> is a hosted repository.

point a client at it

# credentials go inline in GOPROXY
export GOPROXY=https://you:TOKEN@gastropod.io/go
export GOSUMDB=off   # private modules aren't in the public checksum db

How it works

A package flows through Gastropod on its way to a build. Gastropod attaches identity, findings, and provenance that persist everywhere that exact digest appears.

See

An artifact appears via a proxy pull, a push, or a CI job.
Resolve

Gastropod builds an identity: PURL, version, ecosystem, source, and sha256 digest.
Verify

Gastropod verifies each artifact against the authoritative source for its ecosystem, and correlates OSV advisories.
Attribute

Gastropod records who did every pull in the access spine: what they pulled, from where, and when.
Remember

Gastropod attaches advisories, the CycloneDX SBOM, provenance, and dependents to the artifact identity.
Reuse

The next appearance of that exact digest inherits the intelligence, with no rework required anywhere in your organization.

Gastropod vs. a traditional artifact repository

Artifact repositories move bytes reliably; Gastropod does that too, and adds the intelligence and audit layer that other repositories leave to add-ons and higher tiers.

Capability	Gastropod	Traditional artifact repo
Multi-ecosystem proxy & hosted registry	built in	built in
Content-addressed, deduplicated storage	core design	partial
PURL-native artifact identity	first-class	partial
Provenance verification (Go h1, npm SRI, Sigstore)	built in	add-on
CycloneDX SBOM on demand	built in	add-on
OSV advisory correlation at the artifact	built in	separate product
Blast-radius / transitive-dependent graph	built in	limited
Per-pull attribution audit spine	core design	higher tier
Scanner findings ingest (bring your own)	built in	own scanner
Self-hostable	yes	yes

built in / first-class available, often an add-on or higher tier limited or not a focus

This is a directional comparison of the category. Security and intelligence features are generally separate products or higher tiers in traditional artifact repositories. Verify specifics against each vendor's current documentation.

Comparing against a specific product? See gastropod vs. Artifactory, Nexus, or Cloudsmith.

The full feature list

Every capability is on every tier. Rates, limits, and SLA change between tiers; feature access does not.

registry & ecosystems

Proxy & hosted repos for Go, npm, Debian/Ubuntu, OCI, PyPI, Maven & Gradle, Alpine apk, RHEL rpm, NuGet, Ruby (RubyGems)
On-demand source proxies for GitHub & GitLab
Content-addressed sha256 storage, deduplicated across the instance
Virtual / aggregate repositories
Point existing clients at it: no extra tooling required

artifact intelligence

PURL-keyed identity and where-seen history
OSV advisory correlation per package version
CycloneDX SBOM reconstructed on demand
Direct & transitive blast-radius graph
Provenance: Go sum.golang.org h1, npm SRI, Sigstore, signed apt
Identity- and provenance-mismatch flags

control & audit

Per-pull access spine: every pull tied to who did it
Exportable audit log and access events
Block rules at the point of intake
Scanner findings ingest (Trivy, Grype, Snyk, Anchore; CycloneDX, OpenVEX, JSON)

access & security

SSO via OIDC: on every tier
Role-based access control (admin / publisher / reader)
Scoped API tokens
Encrypted in transit and at rest
Per-tenant isolation

deployment & support

Fully-managed cloud, or self-hosted
99.9% uptime SLA (Business); custom SLA (Enterprise)
Full audit log and access events

See it on your own artifacts.

Get started in minutes.

get started contact sales