Teams want to avoid installing packages younger than N days (to let the community catch malicious versions) but there's no simple, cross-ecosystem tool to enforce this without buying a full $300K artifact management platform.
A CLI tool and CI/CD plugin that checks all resolved dependencies against configurable maturity policies (minimum age, minimum downloads, maintainer reputation) and automatically resolves to the closest compliant version. Works as a standalone tool or registry proxy — no JFrog required.
freemium — free CLI for individual use, paid team/org plans ($50-200/mo) with centralized policy management and reporting
The pain is real and validated — the Reddit thread shows teams actively implementing DIY package aging policies and expressing frustration at $300K/year JFrog pricing. However, this is primarily a concern for security-conscious mid-to-large teams, not every developer. Most small teams still YOLO their dependencies. The xz-utils backdoor (2024) raised awareness significantly, but day-to-day urgency varies.
TAM is constrained. The intersection of 'teams that care about package aging specifically' AND 'teams that cannot or will not pay for JFrog/Sonatype' AND 'teams willing to pay for a standalone tool' is relatively narrow. Estimated serviceable market is perhaps 10K-50K teams globally. At $100/mo average, that is $12M-$60M SAM. Decent for a bootstrapped business, too small for VC-scale returns.
Mixed signals. The Reddit pain quotes show people want this, but DevOps tooling has strong free/OSS expectations. Teams already paying for Artifactory/Nexus OSS may resist adding another paid tool. The $50-200/mo price point is reasonable for teams spending $0 today on this specific problem, but you will face constant pressure from DIY scripts and Renovate stabilityDays (free). Enterprise buyers who would pay more likely already have JFrog/Sonatype budgets.
Highly buildable by a solo dev. Core MVP is: query registry APIs (npm, PyPI, Maven all expose publication timestamps), compare against configurable age thresholds, and fail CI or return compliant versions. The deps.dev API and native registry APIs provide all needed data. A CLI + GitHub Action could be MVP'd in 3-4 weeks. The registry proxy mode is harder (4-8 weeks additional) but not required for MVP. Cross-ecosystem normalization is the main complexity.
This is the strongest dimension. There is genuinely no affordable, standalone, cross-ecosystem tool for package age enforcement. JFrog Curation does this but costs $30K+/year minimum. Sonatype Firewall is similar pricing. Socket/Snyk/Phylum do not offer configurable age policies. The only free alternative is Renovate stabilityDays (update-only, not initial install) or DIY scripts. The gap between '$0 DIY' and '$30K+ enterprise' is wide open.
Natural subscription fit — policies need continuous enforcement, new packages are added constantly, and team policies evolve. However, the core value (checking package age) is simple enough that churn risk is real if users feel they can replicate it with a script. Stickiness depends on adding value beyond basic age checking: centralized policy management, audit trails, compliance reporting, multi-ecosystem coverage, and auto-resolution features.
- +Genuine gap in the market — no affordable standalone tool exists between DIY scripts ($0) and enterprise platforms ($30K+/year)
- +Technically straightforward MVP — registry APIs are public and well-documented, 4-week build is realistic
- +Clear pain signal validated by real practitioners expressing frustration with pricing
- +Strong regulatory tailwind — supply chain security mandates (EO 14028, EU CRA) push adoption
- +Natural wedge into broader supply chain security — age gating is a simple entry point that can expand
- !JFrog or Sonatype could unbundle their curation feature into a cheaper standalone product, eliminating the price gap overnight
- !Socket.dev or Snyk could add age-based policies as a feature in their existing affordable plans — this is a feature-level product competing against platforms
- !OSS risk: someone builds an open-source version using deps.dev API + OPA policies — the core logic is simple enough to replicate
- !DevOps teams have strong DIY culture — a 50-line bash script checking npm timestamps may feel 'good enough' for many
- !Selling security tooling to the mid-market is notoriously hard — budget holders often choose free/DIY until a breach forces their hand
A gatekeeping layer within JFrog Artifactory that inspects packages before they enter your internal registry, applying configurable maturity policies including minimum package age, CVE blocking, license compliance, and malicious package detection.
A proxy-level firewall for Nexus Repository that blocks risky components from entering your SDLC based on configurable policies including component age, known vulnerabilities, and license violations.
Supply chain security platform that performs deep behavioral analysis of packages — detecting install scripts, network access, obfuscated code, and other indicators of malicious packages in real-time at the PR/CI level.
Broad developer security platform that scans dependencies for known vulnerabilities
Software supply chain security platform that uses sandboxed analysis and multi-dimensional risk scoring
CLI tool (npm/pip installable) + GitHub Action that reads a .depmaturity.yml config file specifying minimum age (days), minimum downloads, and per-ecosystem overrides. Scans lockfiles (package-lock.json, requirements.txt, pom.xml), checks each dependency against registry APIs, and fails CI with a clear report showing which packages violate policy and what the closest compliant version is. Start with npm + PyPI only. No proxy mode in v1 — pure CI check.
Free CLI for individual use (unlimited, builds community and adoption) -> Team plan at $49/mo adds centralized policy management dashboard, org-wide policy enforcement, audit logs, and Slack/email alerts -> Business plan at $149/mo adds SBOM export, compliance reporting, SSO, and registry proxy mode -> Enterprise at $500+/mo adds on-prem deployment, custom integrations, and SLA
8-12 weeks to first paying customer. Week 1-4: Build CLI + GitHub Action MVP for npm/PyPI. Week 5-6: Launch on Hacker News, r/devops, r/netsec — target the exact audience from the source Reddit thread. Week 7-8: Add team dashboard with basic policy management. Week 9-12: Convert early adopters from free CLI to paid team plans. First meaningful MRR ($1K+) likely by month 4-5.
- “forcing an aging of packages before use. Not perfect, and still looking for other options”
- “We block any package younger than 6 days, and with Compliant Version Selection enabled, the closest compliant version is resolved automatically”
- “$300K a year... insanely expensive”