The Gatekeepers

Veripack is a private, trusted package registry for npm, pnpm, and Bun that audits every release before it becomes installable. Publishers use their normal workflow (or the veripack publish wrapper); each release is stored as pending, statically analyzed without executing package code (install scripts, capabilities, obfuscation, binary/WASM, dependency deltas), and evaluated against a strict team policy with a non-configurable safety floor. Low-risk releases auto-approve; medium/high go to human reviewers (with two-reviewer scopes and per-org self-approval rules); deterministic critical findings are blocked outright. Every verdict is immutable evidence — approvals are bound to an audit ID and policy version, and Postgres triggers make the evidence append-only even against the application's own database role. On the install side, yanked packages return 404 even for lockfile-pinned URLs, a blocklist takes precedence over caches, and every install attempt (allowed or blocked) is synchronously logged. Durable replay jobs, verified backups, MFA/step-up dashboard sessions, and a full audit trail make it production-grade. 168 unit tests and 38 real-Postgres integration tests prove the behavior.