cooldown/proxy

Network-level package quarantine

New dependencies wait at the boundary.

One self-hosted binary enforces a release cooldown for npm, PyPI, and Cargo—across every laptop and CI runner behind it.

Deploy the proxy Test the policy
Ecosystems
npm · PyPI · Cargo
Policy point
One network choke point
Telemetry
None
Topographic map showing fresh package markers stopped at an orange quarantine boundary while established packages sit in a safe basin
Contour 07D Releases cross only after policy clearance

No TLS interception

Immutable artifact cache

Advisory blocks win

JSONL refusal trail

Policy field test

Move the age contour

This local simulation shows exactly what package managers see. No request leaves your browser.

1d 30d 7 days
  • signal-routernpm · v4.8.0 · 0.8d oldQuarantined7d until this version crosses the contour.
  • field-notesPyPI · v2.3.1 · 10d oldAllowedOlder than the active cooldown.
  • vault-doorCargo · v0.9.6 · 32d oldHard blockedAdvisory MAL-2026-041 wins over age and exclusions.

Direct URLs do not bypass the boundary. Every tarball or crate download is checked again against current publish time, exclusions, and advisory blocks.

A small enforcement plane

Policy before package

Keep your existing public registries. Change one registry URL at the organization edge.

  1. 01

    Client asks

    npm, pip, uv, and Cargo speak their normal registry protocols. No wrapper or local plugin.

  2. 02

    Proxy surveys

    Publish time, a live exclusion file, and refreshed advisory feeds resolve to one decision.

  3. 03

    Policy answers

    Old releases pass. Young versions disappear or return 404. Known malware returns 451.

  4. 04

    Evidence remains

    Artifacts cache on disk and every refusal lands in an append-only JSONL audit trail.

Five-minute deployment

One binary. One boundary.

Run behind your existing TLS ingress, then point package managers at its protocol-specific path.

Read the operator guide
client.config
npm config set registry https://registry.internal/npm/
npm install
registry.internal · policy active · 7d

Optional operator pack

Production runbooks, once.

The proxy remains fully open and ungated. A one-time $49 Operator Pack unlocks the hardened ingress checklist, SIEM mappings, incident-response runbook, and hosted-dashboard early access.

One-time purchase. Sociobot/Dodo is the merchant of record and handles refunds; refunded licenses are revoked automatically.

Buy Operator Pack

No license stored. The full proxy remains free.

Hold the line

Make “too new” unreachable.

Open source, self-hosted, and small enough to understand before you trust it.

Get v0.1.0 on GitHubSee client config