Public registries, privately mirrored
Use PyPI, npmjs.org, and Maven Central through an authenticated Ravenstash mirror.
Private package mirrors
Put public dependencies behind a private security boundary.
Use PyPI, npmjs.org, Maven Central, or your own package source through an authenticated mirror with security scanning and minimum package age.
rvs art mirror select pypiorg
rvs pip install torchWhy it helps
A safer, more affordable path to public dependencies
Give developers and CI one authenticated mirror with scanning and release-age controls, without paying for and maintaining separate security systems.
- 1
Choose PyPI, npmjs.org, Maven Central, or another package source your team trusts.
- 2
Put the source behind a private, authenticated Ravenstash mirror.
- 3
Set a minimum package age to hold back releases during their riskiest first hours.
- 4
Builds use dependencies that meet your security and release-age rules.
Security scanning
Screen mirrored dependencies for malware and known security risks before they become trusted build inputs.
Minimum package age
Delay brand-new releases so attacks have less chance to move from publication into CI within minutes.
One protected dependency path
Use the mirror directly or connect it to a matching private PyPI, npm, or Maven repository.
Less registry overhead
Replace separate mirror and security systems with one managed service and one familiar workflow.
Visible and manageable
Review mirrored packages, connected repositories, downloads, storage, findings, and recent activity.
Questions
Private package mirrors without another registry to operate
Protect the public dependencies your team relies on while keeping costs predictable and workflows familiar through rvs.
Can I connect a private external package repository?
Yes. A private mirror can connect to a public or private HTTPS package repository, including sources that require authentication.
Can I use a private mirror without a private repository?
Yes. Every mirror has its own private package URL and can also supply dependencies to one or more private repositories.
How does minimum package age reduce supply-chain risk?
Many dependency attacks rely on a compromised release being adopted immediately. A minimum package age creates time for malicious releases to be reported, removed, or flagged before they enter your builds.