hawk

// Self-Hosted Package Registry Proxy

Every dependency.
Verified at the gate.

Hawk sits between your developers and the public registries. It intercepts every package request, gathers supply-chain intelligence, scans for known vulnerabilities, and runs your TypeScript security policy before the byte lands on disk.

Self-Host in Minutes How it works

Policy Verdicts

lodash@4.17.21

ALLOW

urllib3@1.26.15

DENY

numpy@1.26.0

ALLOW

minimist@1.2.5

QUARANTINE

Ecosystems

Lifecycle

Host calls

// How It Works

A transparent proxy that never gets in your way

Step 01

Developer installs

npm install, pip install, or cargo add — your dev runs the same command they always have.

Step 02

Hawk intercepts

The request hits Hawk first. Supply-chain signals gathered, CVEs checked against OSV, and your TypeScript policy runs - all before the package is forwarded.

Step 03

Package delivered

Clean packages pass through. Violating packages are blocked with an audit log entry and a clear error message.

// What Hawk enforces

Policy at the gate, not in the post-mortem

definePolicy()

Policy as TypeScript

Write your admission logic as real TypeScript and return allow() or deny(). Hawk runs it in a V8 sandbox on every request and fails closed if a policy errors or never reaches a verdict.

ctx.scrobe

Knows who is behind a package

Hawk's scrobe collector enriches every package with maintainer reputation, GitHub repo health, commit-signing rate, and release cadence - all queryable from policy as ctx.scrobe.

OSV.dev

Vulnerabilities, cross-referenced

Every package is checked against OSV.dev, which aggregates NVD, GHSA, and PyPA. Your policy reads the live vulnerability count from ctx.scrobe.vulns and can deny on known-vulnerable releases.

Sigstore / PEP 740

Provenance, surfaced

Hawk detects npm Sigstore provenance and PyPI PEP 740 attestations, exposing has_provenance and has_attestation signals so policy can require a trusted publisher.

Self-Hosted · Your Network · Your Data

Your infrastructure. Your rules. Your data.

Hawk runs as a container against your own Postgres and object store - S3, GCS, Azure Blob, or local disk. Deploy on bare metal, in Docker, or on Kubernetes; your packages, policies, and audit logs never leave your network.

Docker K8s Postgres

// Policy Engine

Your security policy, written in TypeScript

Every package request runs your policy in a V8 sandbox with no filesystem, network, or host access. Return allow() or deny() - anything else, a thrown error or a missing verdict, fails closed. Edit the policy below and watch the verdict change live.

Sandboxed

A fresh V8 isolate per evaluation with zero ops registered. No fs, no network, no syscalls reachable from policy code.

Fail-closed

A transpile error, a thrown exception, or a policy that never calls allow/deny is treated as a deny. Broken policies block.

Hot-reloaded

Policies live in Postgres. A NOTIFY rebuilds the snapshot on every replica in under a second - no restart.

Fires across the package lifecycle

metadata pre_fetch post_fetch serve rescan promote // background

// Live Policy Sandbox Evaluated in your browser · 0 host calls

Examples

policy.ts editable

End with const __policy = definePolicy(...). The preamble provides ctx, allow, deny & the typed signal surface.

Context — ctx

stage

package.name

ecosystem

filename

Intelligence — ctx.scrobe

repo.commit_sign_rate · 90%

Verdict

READY

Edit the policy or context to evaluate.

// Zero Code Changes

Point. Done.

No SDK. No agent. No code changes. Update one line in your package manager config and every developer on your team gets security enforcement automatically.

npm

.npmrc

# .npmrc
registry=https://hawk.your.co/npm/

PyPI

pip.conf

# pip.conf
[global]
index-url = https://hawk.your.co/pypi/

env

# shell or .envrc
export UV_INDEX_URL=https://hawk.your.co/pypi/simple/

Live · npm · PyPI Cargo, Go, Maven & NuGet are rolling out - one config surface, one audit log, one policy set across every ecosystem.

Docker — Point it at your Postgres

# Pull and run Hawk
docker run -d \
  -p 8080:8080 \
  -e HAWK_DATABASE_URL=postgres://... \
  -v ./hawk-config:/etc/hawk \
  ghcr.io/your-org/hawk:latest

Kubernetes — Helm chart

helm repo add hawk \
  https://charts.hawk.your.co

helm install hawk hawk/hawk \
  --set registry.upstream=registry.npmjs.org

// Audit Log

A complete record of every decision

Every allow, quarantine, and deny is written to a structured log with package identity, resolved version, the signals that were evaluated, and the policy that fired.