An internal registry hosts packages your company publishes. A mirror keeps a copy of a public registry. A proxy, also called a pull-through cache, fetches a package from the public registry the first time someone asks and stores it. Most enterprises run one repository manager that does all three jobs.
The three jobs in plain terms
People use these words loosely, which causes arguments in design meetings. Agree on the jobs first, then pick a product.
| Job | What it holds | How it fills up | Typical use |
|---|---|---|---|
| Internal (hosted) registry | Packages you build and publish | Your CI pushes to it | Shared libraries, private SDKs |
| Mirror | A full or filtered copy of a public registry | Scheduled sync | Air-gapped or restricted networks |
| Proxy (pull-through cache) | Only what developers have requested | On first request | Speed, outage cover, one control point |
A repository manager commonly exposes these as a single virtual address, so developers configure one URL.
Why the difference matters for security
A hosted registry is about ownership. You decide who may publish, and you can reserve your internal names so nobody can claim them on the public side.
A proxy is about control of what comes in. Every download passes one place, so you can log it, block known bad packages and apply rules. The cost is that a proxy trusts upstream by default. A malicious version published upstream will be cached if someone asks for it, unless you add rules such as a waiting period or a blocklist.
A full mirror is about availability and review. Because you choose what is copied, you can review before anything lands. The cost is size and sync work. The Maven project notes that mirroring the entire Central repository is not allowed and can get you banned, and recommends a repository manager as a proxy instead. Check each ecosystem's terms before planning a full copy.
How developer tools point at it
Each package manager has its own setting, and each has a precedence order that can surprise you.
- Maven: a mirror entry in settings.xml with a mirrorOf value. Only one mirror can serve a given repository, and the Maven guide says that to present several repositories as one you should use a repository manager.
- Go: the GOPROXY variable takes a comma separated list. The module reference says Go moves to the next entry only when the earlier one answers 404 or 410.
- pip: index-url in pip.conf or the PIP_INDEX_URL variable, with command line flags winning over environment variables, and environment variables winning over files.
- npm: registry and scoped registry lines in .npmrc at project, user and global level.
- NuGet: packageSources in NuGet.Config. NuGet's own documentation says no NuGet setting can stop access to nuget.org, so a firewall is needed to block it.
Choosing what you need
- Start with a proxy. It is the cheapest way to get logging, caching and a single place to enforce rules.
- Add a hosted registry as soon as you have internal packages.
- Add a filtered mirror only if you have networks that cannot reach the internet or a review step that must finish before anything is usable.
- Block direct access to public registries from build networks, or the setup is advisory only.
Try it yourself
Click through it at your own pace, or open it full screen. Look at where each dependency comes from, since that is what a proxy log should also tell you.
Quick check
Is a proxy the same as a mirror?
No. A proxy stores only what has been requested. A mirror copies content ahead of time, usually on a schedule.
Does a proxy block malicious packages by itself?
Not by default. It forwards what upstream serves, so you need blocklists, waiting periods or scanning rules on top.
Safeguard scans dependencies and builds SBOMs, runs reachability analysis, and applies policies and gates on pull requests, so the rules in this post can be checked automatically. Autonomous fix PRs are off by default, with every category on Manual. You can run a free scan at gold.safeguard.sh/scan.
Sources
- Apache Maven, Guide to Mirror Settings: mirrorOf values, single mirror per repository, Central note.
- Go Modules Reference: GOPROXY list and fallback on 404 or 410.
- pip documentation, Configuration: index-url and precedence.
- npm documentation, npmrc: registry and scoped registry settings.
- Microsoft Learn, Common NuGet configurations: package sources and the note on blocking nuget.org.
Last reviewed: 19 October 2026.
