AlienVault (Now AT&T Security USM-Anywhere) should do good things right out of the gate. I like its focus on Kill Chain Taxonomy. If you have no idea what is going on with your network, AlienVault gets you good information quickly. https://cybersecurity.att.com/products/usm-anywhere. Source: almost 2 years ago

Note: Satis is a local repo repository — the pro code is likely not on github. They set up their own system to handle these repositories outside of github/packagist. Source: over 1 year ago

If you want/need to self-host this internally, you can look at satis to create and self-host a repository. Since you need to add the packages manually, your security team can vet the code before adding it. There is a post on gitconnected on how to set this up: https://levelup.gitconnected.com/how-to-host-your-own-private-packagist-for-free-or-extremely-cheap-faf44eca3647. Source: almost 2 years ago

We have a private Satis instance. Our ITSec team reviews all packages before we add them to Satis. Packagist.com is available for us but the CI-CD servers can reach only the private Satis. Source: almost 2 years ago

My team and I use Satis to accomplish that. It's hosted on our servers and we can easily release new versions. Dependabot can even upgrade the dependencies if new ones are detected. Source: almost 2 years ago

Composer supports multiple types of custom respositories, so you can host your own repository (with something like Satis), pay for a packagist.com private repository or even use a VCS repository to fetch packages directly from your private GIT repos. Source: over 2 years ago