Ladon

Nothing enters the build unexamined

Ladon is the private package registry and the gate in front of it. Builds install from Ladon rather than straight from the public internet, and a package only exists in Ladon because somebody looked at it and approved it. The supply chain stops being something that happens to you.

What it gives you

An import queue instead of an install. Asking for a dependency opens a request. Ladon fetches the candidate, checks it, and sorts it: clean packages can be approved in bulk, while anything that raised a flag waits in a separate queue with the reason attached, so attention goes where it is needed. Nothing reaches a build during that wait.

A verdict you can read later. Every decision is written down as a report: what was checked, what the integrity check said, how mature the package is, whether its name is suspiciously close to a popular one, and what the final call was. Rejections are kept too, which is the half most systems throw away.

Exact bytes, every time. An approved version is stored with a cryptographic fingerprint, and that is what installs afterwards. A package that quietly changes upstream cannot quietly change in your builds.

Advisories tracked against what you actually use. Public vulnerability data is matched against the versions in the registry. Each alert can be acknowledged or resolved, and an affected version can be quarantined or sent back for a fresh check.

Install credentials you control. Tokens are issued for installing or for publishing, scoped and time limited, visible in one list and revocable in one click. The secret is shown once and never stored in a form anybody can read back.

A documented way to break the glass. When a release genuinely cannot wait, the override is a recorded act: who did it, why, which packages it covered and for how long, with a cooldown and a re-check afterwards. The emergency exists, and it leaves a trail.

An append only ledger. Approvals, rejections, overrides and token operations all land in one chronological record that can be filtered and exported.

Who it is for

Any team whose production code is mostly other people's code, which is every team. It turns "we trust npm" into a decision somebody actually made.