Secure your PHP supply chain with a private Composer repository

Private Packagist is the single trusted source for packages your developers, CI jobs, and AI agents install. Malware is blocked, security policies are enforced, dependencies are mirrored, monitored for vulnerabilities, and available even when upstream servers are down.

Start Free Trial

Private Composer packages

Manage and browse all your private packages through our web interface. A single repository line in composer.json that never changes connects your projects to Private Packagist: no repository configurations to update whenever you create a new repository.

Learn more

Fast, reliable, and secure Composer deployments

We mirror and cache packages from Packagist.org, GitHub, Bitbucket, and any other source, so deployments keep working even when upstream servers are down. One controlled download path also means malware blocking and your security policies apply to every install, and you always have an overview of the third-party code and licenses in use.

Learn more

Monitor security vulnerabilities

Receive alerts by email, on Slack, on Microsoft Teams, or via webhook when a security vulnerability is reported in one of your dependencies. New projects are analyzed the moment you add them, and weekly or monthly summaries help you track progress.

Learn more

Stay on top of every dependency update

Update Review comments on your pull requests with an easy to scan summary of all composer.lock changes, linked to diffs and changelogs, so no unreviewed dependency change reaches production. Package Usage Tracking shows which applications use a package, so you know exactly what is affected when a security advisory hits.

Update Review Package Usage Tracking

Granular package access for developers, CI, and AI agents

Control who can access which packages. Every developer and every automation, from CI to AI agents, connects with its own credentials, so you can revoke access instantly when someone leaves or an agent misbehaves. You decide who may add new open-source dependencies to your organization.

Integrate easily with GitHub, Bitbucket and GitLab

We fully synchronize teams and repositories from GitHub, Bitbucket and GitLab, making all your private packages instantly available on Private Packagist. Webhooks keep package metadata current the moment you push, so you can run composer update immediately, without waiting for a cronjob or a git clone.

Learn more

Made by the creators of Composer

Private Packagist was founded by Jordi Boggiano and Nils Adermann, the creators of Composer and the open-source package archive Packagist.org. Your subscription funds Composer development and the supply chain security work protecting the whole PHP ecosystem.

Learn more

Getting started

All it takes to start using Private Packagist is to configure this repository in your composer.json, replacing all other private and public repositories.

"repositories": [
    {"type": "vcs", "url": "https://github.com/myorg/pkg1"},
    {"type": "vcs", "url": "https://github.com/myorg/pkg2"},
    {etc...},
    {"type": "composer", "url": "https://repo.packagist.com/myorg/"},
    {"packagist.org": false}
],
"require": {
    "org/pkg1": "^1.0",
    "org/pkg2": "dev-master"
}