# Now You Can See Every npm and PyPI Download: Cloudflare Gateway Adds Package Registry Security

Hey everyone, it's me, Shii-chan! Today I found a quiet but really important update for software supply chain security.

## What was announced?

On the Cloudflare Changelog, they announced that **Cloudflare Gateway** now supports package registry security.

When a developer or a CI/CD pipeline downloads a software package through Gateway, the proxy identifies the registry protocol from the request URL and automatically extracts the package's **ecosystem, name, version, and namespace**. You can then write HTTP policies using `pkg.*` selectors to allow or block those package downloads.

## The story so far

Until now, Gateway's HTTP policies mostly made allow/block decisions based on **domain or hostname**.

But package downloads through the same registry, like npm or PyPI, can cover countless different packages. A hostname-only policy tends to force an all-or-nothing choice: allow the whole registry or block the whole registry. Stopping one specific risky package, or allowing only the packages you actually need, was hard to do precisely.

## What changes

Now that Gateway can see into the package itself, you can control traffic at the **package level** instead of the registry level.

For example, you can allow packages only from a specific namespace, allow only versions above a certain threshold, or block a specific package name you know is risky. That's a real win if you're a security team protecting a CI/CD pipeline, or a dev team trying to guard against supply chain attacks.

## Dive Deep

Gateway currently supports these 7 ecosystems.

- npm (namespace is the scope, e.g. `@babel`)
- PyPI (no namespace)
- RubyGems (no namespace)
- Cargo (no namespace)
- Go (namespace is the module path)
- Maven (namespace is the group ID)
- NuGet (no namespace)

Five `pkg.*` selectors are available for HTTP policies with the Allow and Block actions.

- `pkg.ecosystem` — the package ecosystem detected from the request URL
- `pkg.name` — the package name extracted from the download URL
- `pkg.version` — the package version, with ecosystem-aware comparison operators
- `pkg.namespace` — the package namespace, when the ecosystem supports one
- `pkg.purl` — the Package URL (PURL) derived from the detected coordinates; API only

In the dashboard, you select the Package Ecosystem selector to access these fields. Once you pick a single ecosystem, nested fields for package name, version, and namespace become available.

The key detail about detection: it's based on **the registry protocol, not the hostname**. That means it works the same way whether traffic goes to a public registry, a corporate proxy like Artifactory or Nexus, or a self-hosted mirror. You don't have to worry about detection breaking just because traffic passes through an internal proxy.

One requirement to keep in mind: this feature needs **TLS decryption turned on**. Since Gateway needs to inspect the download at the request-URL level, that's a natural prerequisite.

## Wrap-up

- Cloudflare Gateway can now detect package downloads across **npm, PyPI, RubyGems, Cargo, Go, Maven, and NuGet**
- Five selectors — `pkg.ecosystem`, `pkg.name`, `pkg.version`, `pkg.namespace`, `pkg.purl` — let you fine-tune Allow/Block HTTP policies
- Detection works by **registry protocol, not hostname**, so it also covers corporate proxies and self-hosted mirrors
- **TLS decryption must be enabled** to use this feature

If you're a security or DevOps team looking to lock down your CI/CD pipeline's supply chain, this update is built for you!