Package registry and proxy
One registry in front of all of them
npm, PyPI, Maven, Cargo, Go, NuGet, RubyGems and Debian — proxied, cached, scanned and served from one place, with your private packages in the same namespace.
registry=https://parcel.build/npm/acme/
//parcel.build/npm/acme/:_authToken=${PARCEL_TOKEN}
# pip
index-url = https://parcel.build/pypi/acme/simple/
# cargo
[source.parcel]
registry = "https://parcel.build/cargo/acme/"Why teams put a proxy in front
Upstream outages stop mattering
Once a version is cached it is served from us, forever, regardless of what happens upstream — including a package being unpublished.
Provenance verification
npm and PyPI attestations are verified on fetch. A package whose provenance does not match its claimed source is quarantined, not served.
One place to look
Every dependency your organisation has ever fetched, searchable, with which repository asked for it and when.
Private and public together
Internal packages resolve alongside public ones, with shadowing rules that make dependency confusion impossible.
Fast, and close
Regional caches with warm indexes. A cold `npm ci` on a large monorepo drops from 94 seconds to 21.
Licence and SBOM inventory
Continuous inventory of every dependency and its licence, exportable as SPDX or CycloneDX.
Supply chain
Blocking a bad release before your build sees it
Quarantine rules hold new versions for a configurable window and check them against advisory feeds and provenance before they become resolvable.
- New versions quarantined for a window you set — 0 to 72 hours
- Advisory feeds checked continuously during the hold
- Provenance mismatch blocks a version outright
- Typosquat detection on names close to your existing deps
| Event | Action |
|---|---|
| New version published upstream | quarantined 24 h |
| Advisory published during hold | blocked, team notified |
| Provenance does not match repo | blocked outright |
| Name within edit distance 1 of a dep | flagged for review |
| Version unpublished upstream | still served from cache |