gastropod is live!
gastropod.io is live!
Somewhere right now, an advisory is dropping on a package half the industry depends on. And inside every affected company, the next hour looks the same: 'are we running it? where? since when? who pulled it in?' followed by a very long week of grepping build logs, diffing lockfiles, and asking in Slack whether anyone remembers deploying the thing.
Not because anyone did anything wrong. Because the infrastructure that serves up these packages and artifacts doesn't keep track of it.
the registry has amnesia
Every artifact you build on passes through a registry. It sits in the path of nearly everything and it's just not built to remember and keep track of things. It moves bytes and keeps no notes: where the package came from, whether its signatures checked out, who pulled it, where else the same digest already lives. So organizations compensate downstream, re-resolving and re-scanning the same artifact in every repo, every pipeline, every team. This is how things have worked. This work that recently got dramatically more expensive with AI-based vulnerability scanning metering in tokens.
we built one that remembers
gastropod is an artifact registry with a memory. When a package flows through on its way to a build, gastropod fixes its identity to the digest, verifies provenance against the upstream checksums and signatures, correlates known advisories, and records the pull — who, when, from where. All of it stays attached to that exact artifact. The next time the same digest appears — another app, another team, another pipeline — everything known arrives with it. The next time an advisory is published against an artifact you know where it is being used immediately.
Your scanners come along too: point Trivy, Grype, Snyk, Black Duck or any/all scanners you use at gastropod and their findings pin to the digest instead of evaporating into per-project reports. And it's one system — registry, SBOMs, advisories, blast radius, audit, every feature on every tier.
ready - set - go
We left stealth a few weeks ago to announce we were building and testing with early adopters. Today the product is live & speaking the ecosystems most teams run: npm, PyPI, Go, Maven & Gradle, containers, and more. There's a free trial you can stand up in minutes, and nobody will make you take a call first. Check us out, give us a try!