GitLab

A private npm registry that sits between developers and the public npm
registry. Approved packages get through and get cached, everything else
gets a clear 403 telling the developer how to ask for it.

- whitelist or blacklist mode, with the whitelist as the default
- rules by exact name, wildcard, or semver range, so a single version
  can be approved or a bad release retired
- metadata is filtered, so a blocked version is never offered to npm
- tarballs cached on disk and checked against the published hash
- role based access with a request and approve workflow
- ip whitelist on the portal with break glass keys to get back in
- import and export of rules as json or csv
- audit trail of every change and every sign in

Runs as one container with its own mysql. Only a reverse proxy sits
outside it.