Policy

The Policy tab is where you configure the security controls that Secure Registry enforces. Every package request that flows through Secure Registry is evaluated against the controls you enable here before a response is returned.

Open the Policy tab and use the Registry selector to choose an ecosystem (npm or PyPI), then toggle each control on or off. Controls are configured independently per ecosystem, so your npm and PyPI policies can differ. Click Save Changes to apply.

Cooldown Period

Blocks packages published within a configurable number of days, giving the community and StepSecurity's SOC time to vet new releases before they reach your environment. Set the cooldown window in the Period (days) field; the default is 2.

Cooldown is the first line of defense against zero-day supply chain attacks. Most malicious packages are discovered within 24 hours of publication, so a multi-day cooldown shifts the discovery window outside your installation window.

Exempted Packages

Use the Exempted Packages field to allow specific packages or scopes to bypass the cooldown window. Type a pattern and press Enter to add it. Patterns are matched as regular expressions, so you can exempt a single version, an entire package, or a whole scope.

Pattern	What it exempts
react@2.3.4	A single version of one package
lodash@*	All versions of one package
@scope/*	All packages under a scope

Exempted packages still flow through Secure Registry and are evaluated by every other enabled control (for example, Compromised Packages). Only the cooldown check is skipped.

Use exemptions sparingly. Each exempted pattern is an explicit opt-out of the zero-day window, so reserve them for packages you have already vetted or that you control internally.

Compromised Packages

Blocks installs of package versions that StepSecurity's SOC or the broader security community has flagged as compromised or malicious. When this control is on, any request for a flagged version is blocked, and the evaluation is recorded in the Policy Evaluations log.

This control catches packages whose maintainer account was hijacked, packages that were published with embedded malware, and packages reported as malicious after publication. Unlike Cooldown, which buys time for the community to discover an attack, Compromised Packages enforces against attacks that have already been confirmed.

Compromised Packages is independent of the cooldown window: a flagged version is blocked whether or not it falls inside the cooldown period, and exempting a package from cooldown does not exempt it from this control.

Typosquatting Protection

Blocks packages whose names closely resemble popular packages, protecting against typosquatting attacks. When this control is on, a request for a package whose name is a likely typo of a well-known package is blocked, and the evaluation is recorded in the Policy Evaluations log.

Whitelisted Packages

Use the Whitelisted Packages field to allow specific packages through the typosquatting check. Type a package name and press Enter to add it.

Unlike the Cooldown Exempted Packages field, which matches regular expressions, the whitelist requires exact package names. Specify the full name of each package you want to allow (for example, @scope/package-1 or lodash); patterns such as lodash@* or @scope/* are not supported here.

Whitelist a package when its name legitimately resembles a popular package and the Typosquatting control is flagging it as a false positive. Whitelisting affects only the typosquatting check; the package is still evaluated by every other enabled control.

Saving changes

Changes to the Policy tab take effect only after you click Save Changes. The page records who last saved the policy and when, so you have a basic audit trail of policy changes per ecosystem.