Gateway detects and controls software package downloads

Cloudflare Gateway can now detect software package downloads and give you policy control over supply chain traffic. When a developer or CI/CD pipeline downloads a package through Gateway, the proxy identifies the registry protocol from the request URL and extracts the package ecosystem, name, version, and namespace. You can then write HTTP policies using pkg.* selectors to allow or block package downloads.

Supported ecosystems

Gateway detects package downloads for the following ecosystems:

Ecosystem	Namespace
npm	Scope (for example, @babel)
PyPI	--
RubyGems	--
Cargo	--
Go	Module path
Maven	Group ID
NuGet	--

Selectors

In the dashboard, select Package Ecosystem to access the package registry selectors. After selecting a single ecosystem, nested fields for package name, version, and namespace become available. Five pkg.* selectors are available for HTTP policies with the Allow and Block actions:

Selector	Description
pkg.ecosystem	The package ecosystem detected from the request URL.
pkg.name	The package name extracted from the download URL.
pkg.version	The package version, with support for ecosystem-aware comparison operators.
pkg.namespace	The package namespace, when the ecosystem supports one.
pkg.purl	The Package URL (PURL) ↗ derived from the detected coordinates. Available in the API only.

Detection is based on the registry protocol rather than the hostname, so it works the same way whether traffic goes to a public registry, a corporate proxy such as Artifactory or Nexus, or a self-hosted mirror.

Package registry security requires TLS decryption to be turned on.

For more information, refer to Package registry security.