Your team's packages. One home.
Publish private npm packages with familiar tools. Give developers, agents and CI scoped access to the versions they need.
PRODUCT VISION / BUILT ON CLOUDFLARE
Packages your builds
can depend on.
A managed package registry for private code and public dependencies. Publish, mirror and protect the packages your developers and agents need—even when an upstream registry is unavailable.
Project: checkout-service Source: package-lock.json ✓ Exact versions recorded ✓ Package archives mirrored ✓ Integrity checks passed ✓ Current policy satisfied Upstream unavailable? Serve verified, retained dependencies. Illustration of the target experience.
Private npm publishingDurable dependency mirrorsLockfile readinessPackage security policies
Keep the dependencies you rely on.
Retain verified public package archives and the metadata needed to serve them. Make dependency availability an explicit part of build readiness.
Make every decision explainable.
Apply release holds and package rules alongside maintained risk intelligence. Explain blocks with evidence and a path to resolution.
RELIABILITY BY DESIGN
An upstream outage
shouldn't stop a prepared build.
The target: a project with fully mirrored npm dependencies can install them through PKGG while the public npm registry is unavailable.
Start with the lockfile.
Resolve the exact dependency inventory, fetch supported package archives and retain their integrity records and registry metadata. Report missing or unsupported sources explicitly.
Know what is actually ready.
Produce a readiness report tied to the lockfile and retained artifacts. Confirm availability and current policy before claiming that dependencies are ready.
Serve retained versions.
Use the gateway for package delivery when npm is unreachable. Fresh versions that have not been mirrored remain dependent on the upstream registry.
Recheck security at download time.
Retention does not override policy. A newly blocked version stays blocked even when its archive is available in storage.
A precise availability promise.
Readiness covers supported, retained npm dependencies. PKGG and its authorization services must remain available. Install scripts that download external files, Git dependencies and other build services require separate handling.
FAMILIAR TOOLS. FEWER MOVING PARTS.
Connect. Prepare. Keep building.
Keep npm in the workflow, with a service behind it that brings package delivery and policy together.
For individual developers.
The proposed free entry point offers public dependency protection with no signup or token. A small CLI configures a project, checks readiness and explains decisions. Participation is optional and configuration can be undone.
For teams.
Authenticate to publish private packages, manage retention and set environment policies. Scoped credentials connect laptops, CI and coding agents to the same registry.
A CLOUDFLARE FOUNDATION
Package delivery meets
network enforcement.
Build on the existing PKGG foundation, then connect package intelligence to the services that already manage developer access.
Workers, R2 and Durable Objects.
PKGG already uses Workers for its API, R2 for package archives, and Durable Objects for organization policy state. D1 holds account and catalog records.
Cloudflare One and Access.
Connect managed device controls to package policy, restrict alternate registry downloads, and integrate corporate identity. Validate the enforcement path and deployment requirements before rollout.
PKGG is an independent project built on Cloudflare. The integrations described here are proposals; this page does not announce an official Cloudflare product or partnership.
PROPOSED FEATURE SET
A focused npm release.
Room to grow.
This is the intended product experience. The release scope below includes capabilities still to be built and validated.
Publish and deliver.
- Private npm publishing and scoped read/write access.
- Public npm proxying with durable archive and metadata retention.
- Lockfile prefetch, integrity checks and readiness reporting.
- Verified installs during a simulated upstream outage.
- A distributable CLI with setup, diagnostics and undo.
Protect with evidence.
- Trusted threat-feed ingestion with traceable verdicts.
- Release-age and package/version policies.
- Current policy checks for retained packages.
- Clear block reasons, remediation and download audit records.
- A free public consumption path without an account.
Connect the organization.
Cloudflare One enforcement, corporate identity, time-limited approval workflows, and exposure investigation based on observed downloads and local project checks.
Broaden the ecosystem.
Additional package formats, migration tooling, reviewed community risk reports and richer build provenance. Extend the service after validating the npm experience.
THE FIRST PROOF
Turn off the upstream. Install the prepared project.
Demonstrate a clean npm install from retained dependencies, enforce a blocked version, and explain the result. That is the first end-to-end milestone for this proposal.
Review the feature set ↑