Let new releases bake.
Give new package versions time before they reach your projects. Start with a 48-hour hold and choose longer windows where stability matters most.
DEPENDENCY CONTROL FOR DEVELOPERS & AGENTS
Your dependencies.
Your rules.
Give developers and coding agents a shared set of rules for the packages they install. Set release holds, define policies for each environment, and see what enters your codebase.
# Every gateway request has a context Organization Acme Environment production Release hold 48 hours ✓ Established release → eligible ⏳ New release → waiting for bake time ✕ Blocked version → download denied Same policy for people, agents and CI.
Organization-wide policiesEnvironment-scoped accessFamiliar npm workflows48-hour release hold
Different environments. Clear rules.
Keep development flexible and production deliberate. Apply a shared organization baseline, then add environment-specific requirements.
Understand every decision.
See which downloads were allowed or blocked, the policy behind each decision, and the changes your team made along the way.
POLICIES THAT FOLLOW YOUR TEAM
Decide once.
Apply it to every gateway install.
An agent can choose a dependency. Your organization decides whether that version belongs in its environment.
From a rule to a repeatable decision.
Define release-age requirements and package allow or deny rules. Prepare changes as drafts, activate them when ready, and keep a revision history as your requirements evolve.
The right access for each workflow.
Invite teammates, assign roles, and issue expiring tokens for specific environments. Developers, automated jobs and agents use scoped credentials while admins retain control of policy.
Cached packages still follow policy.
A previous download does not make a version exempt. Gateway requests are evaluated against the current rules, and archive checksums are verified before delivery.
FROM FIRST PROJECT TO THE WHOLE TEAM
A familiar workflow.
A shared layer of control.
Start with one project and bring the same approach to your teammates, CI jobs and coding agents.
Bring your team together.
Create an organization, invite teammates and choose who manages policy. Individual developers can use the same workflow for their own projects.
Make expectations explicit.
Set your baseline release hold and package rules. Add requirements for development, staging and production, then grant access to the appropriate environments.
Configure once. Scan before installing.
Generate a scoped token and use the CLI to configure your project. Scan its lockfile to understand which dependencies meet policy and which need attention.
Keep decisions visible.
Track packages, review blocked requests and inspect audit history. Update policy as your team learns, with a clear record of what changed.
COMMUNITY EXPERIENCE, SHARED RESPONSIBLY
Turn “is it just me?”
into useful risk signals.
Broken installs, unexpected behavior and release regressions are easier to investigate when developers can compare evidence. Community contributions give teams another source of context for package decisions.
Reports with evidence.
Connect an issue to a specific package and version. Share reproduction steps and observations so reviewers can distinguish an isolated problem from a wider pattern.
Recognition for useful contributions.
Recognize contributors through reviewed reports and reputation. Reward clear, reproducible evidence that helps others make better decisions—not simply more submissions.
Community input informs judgment.
A report is a signal to investigate, not an automatic verdict. Review evidence alongside your organization’s policies before changing what your team permits.
CLEAR EXPECTATIONS
Know what your controls mean.
What does a release hold do?
It creates an observation window between publication and installation. It does not guarantee that an older package is safe, and an artifact checksum verifies integrity rather than intent.
How do agents follow the same policies?
Give the agent an environment-scoped token and configure its package manager to use the gateway. Requests through that gateway follow the same policy as developer and CI requests.
Does configuring the registry prevent every bypass?
Registry configuration directs supported package requests through the gateway. Environments that require mandatory enforcement also need network and cache controls for direct downloads, Git dependencies and install scripts.
ONE TEAM. A SHARED PACKAGE POLICY.
Move quickly, with clear boundaries.
Bring dependency decisions into the same place as your team, environments and audit history.
Explore the workflow ↑