OSV vulnerability scanning for package registries

Scan packages against the public OSV database where they already live. Optional install-time blocking for known malware and severity floors on your self-hosted registry.

Solutions

• Self-hosted package registry for DevSecOps
• Unified package registry for polyglot teams
• Package registry for multi-vertical platforms

Product

• Unified multi-ecosystem package registries
• OSV vulnerability scanning for package registries
• Self-hosted package registry on your infrastructure
• SSO, PATs, and org RBAC for package registries

Self-hosted registries

• Self-hosted package registries
• Self-hosted npm registry
• Self-hosted Composer registry
• Self-hosted Docker registry
• Self-hosted PyPI registry
• Self-hosted Go module registry
• Self-hosted Cargo registry
• Self-hosted Maven registry
• Self-hosted RubyGems registry
• Self-hosted Conan registry
• Self-hosted multipurpose artifact registry

Documentation

• Quickstart
• Install with Docker Compose
• Install with Helm
• Install with Ansible
• Install on AWS, Azure, or DigitalOcean
• Core concepts
• Registries
• Vulnerability scanning
• Single Sign-On (SSO)
• API reference

Latest from the blog

• When npm audit Goes Down: Why External Security APIs Break Your CI/CD
• 3CX and the trust you never audited: controlling what enters your software supply chain
• A package in your inventory just went malicious—what you do in the first hour
• Install protection is a policy, not a scanner checkbox
• Your coding agent still talks to the public registry