Registry Proxy

The registry proxy keeps your supply chain safe by blocking malware, enforcing minimum package age, and offering patched versions of vulnerable packages.

Instead of pulling packages directly from the public registry, your private registry routes requests through Aikido's proxy.

Aikido inspects each package before it reaches your environment: blocking known malicious packages and rejecting packages that are too new to be trusted. You can find the proxy URL in the Aikido UI.

Currently npm, PyPI, Maven and NuGet are supported. Support for additional package managers is coming soon.

Blocking malware

The registry proxy blocks packages that contain malware so the malware doesn't reach your development environment, pipelines or production environment.

Packages are blocked based on the Aikido Intel malware feed at https://intel.aikido.dev/malware.

Minimum package age

Package versions pushed in the last 48 hours are not available through the Registry Proxy. This gives our malware team time to inspect the new package versions for malware.

The minimum package age can be configured per ecosystem (eg. npm, pypi) in the Aikido UI. Go to Devices > Settings and click on the ecosystem to configure the minimum package age. When configured the Registry Proxy uses the devices minimum package age instead of the 48 hours default.

Patched libraries

Aikido Libraries alllow you to avoid breaking changes by staying on the same version of the library. Aikido produces patched libraries for old version of the libraries mitigating known critical and high vulnerabilities.

A list of Aikido Libraries can be found in the Aikido UI under AutoFix > Libraries. Use AutoFix to create PRs to update to the Aikido Libraries.

Supported Registries

JFrog ArtifactoryAzure DevOps ArtifactsSonatype Nexus RepositoryGoogle Cloud Artifact RegistryCloudsmith

On-Premise Registry Proxy

On-Prem Registry Proxy