Supply chain attacks are starting to feel like part of the daily routine.
You grab your morning coffee, open the laptop, and check which package ecosystem is on fire today.
Malicious packages, compromised maintainers, typosquatting, dependency confusion, suspicious new releases — the public package ecosystem is powerful, but we also trust it a lot by default.
There are mature tools for this. JFrog, Sonatype, Synk, and similar platforms exist for a reason. But not every small team, startup is ready to buy and operate a full artifact-management platform.
So I started thinking about the gap between:
“we do nothing”
and
“we adopt a full enterprise solution.”
The idea was simple:
What if package installs had a lightweight policy checkpoint?
Kind of like Cloudflare, but for dependencies.
Your existing tools still work mostly the same:
pip install ...
uv add ...
poetry add ...
But instead of talking directly to PyPI, they go through a small proxy first.
That proxy can decide whether to allow, block, warn, or log a package request based on policy. For example:
- block packages released in the last 7 days;
- block yanked versions;
- block certain licenses;
- block known-bad publishers or package names;
- log every decision for audit/debugging.
That became FrontGate.
FrontGate is a small Go-based POC that sits between Python package clients and PyPI. It implements a PEP 503-compatible proxy surface, supports policy config via YAML, exposes Prometheus metrics, and has integration examples for pip, Poetry, uv, and CI.
It is intentionally not a private registry.
It does not try to store artifacts.
It is just a policy layer before dependencies reach your resolver.
The first use case I wanted to explore is release-age gating: blocking packages that are too new. It is not a silver bullet, but it can reduce exposure to freshly published malicious versions before the ecosystem has time to react.
But I think the idea is worth testing:
Can we make dependency installation a little less blind without introducing a heavy platform?
Repo: https://github.com/maxkrivich/frontgate
Curious if this is a problem other people have run into, especially in small teams or platform/security work where “buy the full thing” is not always the first option.