The problem
Open-source packages are most of a modern application and the easiest way in for an attacker. A hijacked maintainer account, a typosquat or a look-alike of an internal package can reach thousands of builds within hours.
Most teams rely on scanners, which run after download. By then the install script has already executed on a laptop or build runner.
How DepGate helps
DepGate is an open-source (MIT) dependency gateway that moves the decision to the moment of download. Developers and CI point npm, pip, mvn, go, dotnet, cargo, composer or gem at DepGate instead of the public registry. Each version is checked against a malware feed and your policies, then served or refused with HTTP 403 naming the policy, the finding and the newest allowed version.
Features
- Eight ecosystems, one gateway: npm, PyPI, Maven, Go, NuGet, Cargo, Composer and RubyGems.
- Malware blocked by default: a synced feed of more than 200,000 known-malicious packages.
- Readable policies: block by CVSS and EPSS, license, release age, release type, OpenSSF Scorecard or name.
- Monitor before you enforce: see which downloads a policy would break first.
- Dependency-confusion protection: internal package names resolve only from internal registries.
- Developer self-service: Package check and time-bound waivers.
- Decision Ledger and Audit Log: who installed what and why, streamed to your SIEM.
- Enterprise ready: SSO, short-lived CI tokens, one self-hosted container.
How it compares
Sonatype Repository Firewall and JFrog Curation pioneered this idea and are mature, but they are commercial add-ons. DepGate is free and runs in front of, or behind, the Artifactory or Nexus you already have.
| DepGate | Sonatype Firewall | JFrog Curation | |
|---|---|---|---|
| License | MIT | Commercial | Commercial |
| Ecosystems | 8 | 17+ | All Artifactory formats |
| Malware, vulnerability and license rules | ✅ | ✅ | ✅ |
| Monitor mode with impact report | ✅ | Partial | ✅ |
| Dependency-confusion protection | ✅ | ✅ | Partial |
| Heuristic detection of new malware | Roadmap | ✅ | Partial |
Based on public documentation as of October 2026.
Try it
You can see your first block in about ten minutes. You need Docker with Compose v2, Git, and Node.js.
1. Start DepGate. The script creates its secrets and a local HTTPS certificate, then starts DepGate, PostgreSQL and Redis:
git clone https://github.com/secmods/depgate.git cd depgate/deploy/all-in-one ./quickstart.sh
2. Sign in. Open https://localhost and sign in as [email protected], using the password the script prints. Eight starter policies are already in place, among them Critical vulnerabilities (CVSS 9.0 or higher).
3. Connect npm. Go to Registry, copy the .npmrc snippet into an empty folder, and tell npm to trust the local certificate:
npm config set cafile /path/to/deploy/all-in-one/certs/ca.crt --location=project
4. Install something. A healthy package installs as usual. A vulnerable one doesn’t:
npm install express # allowed npm install [email protected] # 403: blocked by "Critical vulnerabilities", CVE-2021-44906
5. See why. The Decision Ledger records the block along with the policy, the CVE and who made the request. Package check lists which minimist versions are allowed and the newest one you can use. From there you can try a policy of your own in monitor mode, or connect pip, Maven or Go.
For production, follow the Docker or Kubernetes guide. Star the repo, read the docs, and open an issue to tell us what to build next.
