Package Sentinel: Security & Governance for Azure Artifacts
See the state of every Azure Artifacts feed in one place, and act on it safely. Package Sentinel does not replace Azure Artifacts. It reads your real settings, compares them with rules you control, and shows what needs attention.
Features
Feed Security Audit
Reads actual feed permissions and flags broad access (for example a "Valid Users" group with Contributor rights).
Flags unexpected Contributors and Owners against an approved list you maintain.
Flags too many owners, enabled upstream sources, and missing retention policies.
Detects access changes against a baseline you save.
Findings are rated HIGH, MEDIUM or LOW. Every finding comes from a stated rule, not a guess.
Package Lifecycle Dashboard
Sort and filter packages by version count and time since last publish.
Labels such as Multiple versions, Outdated, Pre-release only, and Retention policy needs review.
"No recent publish activity" is not "unused". A package with no recent publishes can still be downloaded every day, so Package Sentinel never calls a package unused.
Retention Policy Analyzer
Shows the current policy: versions kept per package and days to keep recently downloaded versions.
Simulates a new limit and lists the packages and versions that would become eligible for removal. Versions promoted to a view are exempt.
Read-only. You change the policy in Azure Artifacts feed settings.
Safe Cleanup Preview
Shows versions found, selected for cleanup, and protected, with the reason for every protected version (latest, promoted to a view, newest N, recent).
Nothing is deleted without your explicit confirmation. Deleting is off by default and, when enabled, requires typing the package name. Versions go to the recycle bin and can be restored for 30 days.
Supports NuGet, npm, Python, Universal and Maven.
Permissions
Packaging (read, write and manage). Read is used for scans. Manage is used only when you confirm a deletion. The extension has no servers and sends no data anywhere.
Get started
Install the extension. A Package Sentinel entry appears in the project navigation.
Questions go in the Q&A tab of this page. Bugs and requests go to GitHub issues.
بالعربية
Package Sentinel أداة مراقبة وحوكمة لـ Azure Artifacts: تدقيق صلاحيات الـ Feeds، لوحة لحالة الحزم، تحليل سياسات الاحتفاظ، ومعاينة آمنة للتنظيف. لا يُحذف أي إصدار دون تأكيد صريح منك، والحذف معطّل افتراضياً.
