artifactory-pypi-scanner VS verdaccio

To mitigate this kind of supply chain attacks for python, we have created following tool [1], that will check python packages on Artifactory instance you specify and create packages with the same name on the PyPi.

[1] https://github.com/pan-net-security/artifactory-pypi-scanner

do you know the project https://github.com/verdaccio/verdaccio

Verdaccio allows to setup a private proxy registry for Node.js

Verdaccio does okay for this

There’s also this: https://www.npmjs.com/package/verdaccio

Cool! What makes Package Depot better than existing solutions such as verdaccio?

I highly recommend using a package proxy like https://github.com/verdaccio/verdaccio instead of git submodules if you have more then one developer using your code/repo. Biggest factor is the cost of the developers time. Why teach them a different way to install dependancies when there is a standard way of doing things your CI/CD is simplified, the knowledge of git submodules is good to know, but this is now tribal knowledge on how to setup this up, update dependancies, etc...

The goal of verdaccio is to make this less complicated. https://github.com/verdaccio/verdaccio