Show HN: Stop malicious packages before NPM/pip install – open-source gateway

Category: security

Tags: supply-chain-security, package-manager, proxy, policy-engine

Score: 7.0/10 (Innovation: 6, Technical: 7, Documentation: 8, Utility: 7)

DepGate is an open-source dependency gateway that proxies package manager requests to public registries and enforces security policies (malware blocking, CVE/license/age rules) before packages are downloaded. It supports eight ecosystems with a unified policy engine, decision ledger, and SSO, addressing a real supply-chain security gap. The project is well-documented with a demo and screenshots.

Target audience: devops, security engineers, backend devs

Repository: https://github.com/secmods/depgate · TypeScript · MIT · 10 stars

View on Hacker News