What it is: a self-hosted caching proxy (git-pkgs/proxy, one Go binary) between everyone at work and npm, PyPI, pub, Maven and Go. New releases stay hidden for a week, and every download is logged with who pulled it.

Why: this year's big hijacks were all pulled within a few hours, so a week means you basically never see them.

The post has the config, what broke, and the built-in settings if you'd rather not run a proxy.