A package registry is a service that stores software libraries and lets developers publish, search, and install them. Registries are central to modern development because build tools pull dependencies from them automatically, often with little manual review. They also manage metadata such as version numbers, authorship, checksums, and access permissions.
In cyber security, registries matter because they sit in the software supply chain. Attackers may upload typosquatted, malicious, or compromised packages to reach downstream applications, while defenders use controls such as multi-factor authentication, signing, provenance checks, anomaly detection, and strict publishing permissions. When a registry is abused, the risk can spread quickly to many projects that trust it.