What is DepAegis?

DepAegis is an enterprise-grade private package registry with supply chain security built in. It provides a single platform for hosting npm, NuGet, and Docker/OCI packages with automated vulnerability scanning, SBOM generation, and policy enforcement.

Why DepAegis?

Modern software depends on hundreds of open-source packages. Each dependency is an attack vector. The Software Supply Chain — the process of writing code, building packages, publishing, and consuming them — needs protection at every step.

DepAegis gives teams a private, controlled registry that sits between the public ecosystem and your production code, enforcing security policies at the point of consumption.

Key Features

Multi-Format Package Registry

Host npm, NuGet, and Docker/OCI packages in a single unified registry. No need for separate tools — DepAegis handles all three natively with format-specific APIs that are 100% compatible with standard tooling.

Vulnerability Scanning

Every package published to DepAegis is automatically scanned against the Open Source Vulnerabilities (OSV) database and the National Vulnerability Database (NVD). Vulnerable packages are quarantined and flagged with severity ratings (Critical, High, Medium, Low).

SBOM Generation

DepAegis automatically generates a Software Bill of Materials (SBOM) in CycloneDX format for every package. This provides a complete inventory of dependencies, enabling compliance with the EU Cyber Resilience Act (CRA) and other regulatory frameworks.

Dependency Firewall

Define Open Policy Agent (OPA/Rego) policies that govern which packages are allowed into your organization. Block packages with specific licenses, known vulnerabilities, missing attestations, or packages from untrusted authors — before they reach your build pipeline.

Signing & Provenance

Leverage SLSA provenance and Sigstore keyless signingto verify that packages were built by trusted CI pipelines and haven't been tampered with. Every package carries cryptographic proof of its origin.

Organizations & Access Control

Organize packages into organizations with fine-grained role-based access control. Manage teams, set publish and consume permissions, and audit every action through a comprehensive activity log.

How It Works

DepAegis sits between your developers and the public package ecosystem:

1. Developers configure their package manager (npm, dotnet, docker) to point to DepAegis as the registry.
2. Published packages are scanned for vulnerabilities, an SBOM is generated, and provenance is verified.
3. Policy Engine evaluates packages against your organization's rules (license, vulnerability, provenance).
4. Consumers can only install packages that pass all policy checks.

Hosting