The four registries scientists rely on gate packages differently. CRAN checks policy and builds, Bioconductor adds volunteer peer review, conda-forge reviews recipes by pull request, and PyPI publishes uploads without a manual content review. So the trust you must add yourself differs for each.
What each documents
The statements below come from each project's own documentation, linked in the sources.
| Registry | Documented gate | Human review of new packages |
|---|---|---|
| CRAN | Packages expected to pass R CMD check as CRAN, clear ownership, no malicious behavior | Yes, volunteers on the CRAN team check submissions |
| Bioconductor | Peer review by volunteer reviewers, typically 2 to 6 weeks | Yes, per package |
| conda-forge | Recipe pull request reviewed by the conda-forge team, checksum and test required | Yes, of the recipe |
| PyPI | Trusted publishing and attestations available as options for maintainers | Cited pages describe publishing mechanisms, not a manual review |
This comparison makes no claim about manual content review on PyPI, because the pages cited here do not describe one. Check PyPI's current policies before you assume either way.
What to add yourself
A review on the way in is only one layer. Add your own, whatever the registry.
- Identity of the package. Confirm the name, maintainer and project page. Typosquatting happens everywhere. See how to protect your package names from squatting.
- Provenance. Where a registry supports signatures or attestations, check them. See PyPI attestations explained.
- Exact versions. Lock them, as in the conda lockfile guide.
- Known vulnerabilities. Scan the lockfile on a schedule.
- Abandonment. Watch for packages that stop receiving updates. See what to do when a research tool maintainer disappears.
A simple decision rule
If a package comes from a registry with human review, you still scan it. If it comes from one with lighter gating, you also inspect the maintainer, the release history and any install scripts before you adopt it. Either way, record why you trusted it.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how reachability helps you focus on the findings that can actually run in your analysis.
Quick check
Does review at the registry replace my own scanning?
No. Review checks fit and policy at submission time. New advisories arrive later, so scan on a schedule.
Which registry is safest?
Safety depends on the specific package, its maintainers and your use. Compare gates, but judge each dependency on its own record.
Safeguard's SBOM and dependency scanning covers packages across these ecosystems, and a free scan is available.
Sources
- CRAN Repository Policy
- Bioconductor Package Submissions
- Adding packages, conda-forge
- Publishing to PyPI with a Trusted Publisher
- Digital Attestations, PyPI Docs
Last reviewed: 19 October 2026.
