| Ecosystem | Repository | Operator | Purpose / Notes |
|----------------|--------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Java / JVM** | [Maven Central](https://central.sonatype.org/) | Sonatype | Default JVM repo; [immutable releases](https://central.sonatype.org/publish/requirements/immutability/). |
| | [Google Maven](https://maven.google.com/) | Google | Android/Google libs; standard in Android builds ([Android docs](https://developer.android.com/build/remote-repositories)). |
| | [JitPack](https://jitpack.io/) | JitPack | Builds artifacts from Git tags/commits; [immutable after 7 days](https://docs.jitpack.io/#immutable-artifacts). |
| | [JCenter (historical)](https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/) | JFrog | Sunset/read-only; traffic redirected to Maven Central. |
| | [GitHub Packages (Maven)](https://docs.github.com/packages/working-with-a-github-packages-registry/working-with-the-apache-maven-registry) | GitHub/Microsoft | Public/private Maven packaging integrated with GitHub auth. |
| **JavaScript** | [npm Registry](https://www.npmjs.com/) | npm/GitHub (Microsoft) | Largest JS registry; [lifecycle scripts](https://docs.npmjs.com/cli/v8/using-npm/scripts/); [npm audit](https://docs.npmjs.com/cli/v8/commands/npm-audit/). |
| | [GitHub Packages (npm)](https://docs.github.com/packages/working-with-a-github-packages-registry/working-with-the-npm-registry) | GitHub | Hybrid public/private npm registry. |
| **Python** | [PyPI](https://pypi.org/) | Python Software Foundation | Official repo; [no filename reuse](https://pypi.org/help/#file-name-reuse); [OIDC Trusted Publishing](https://docs.pypi.org/trusted-publishers/). |
| | [conda-forge](https://conda-forge.org/) (on [Anaconda.org](https://anaconda.org/conda-forge)) | Community | Community-run packaging; large Conda ecosystem. |
| **.NET** | [NuGet.org](https://www.nuget.org/) | Microsoft | Central .NET repo; [ID Prefix Reservation](https://learn.microsoft.com/nuget/nuget-org/id-prefix-reservation); [NuGetAudit](https://learn.microsoft.com/nuget/concepts/package-security#nuget-audit). |
| **Containers** | [Docker Hub](https://hub.docker.com/) | Docker | Largest image registry; [tags mutable, digests immutable](https://docs.docker.com/dhi/core-concepts/digests/); [Docker Content Trust retired](https://www.docker.com/blog/retiring-docker-content-trust/). |
| | [GitHub Container Registry (GHCR)](https://docs.github.com/packages/working-with-a-github-packages-registry/working-with-the-container-registry) | GitHub | OCI images with repo/org-scoped permissions. |
| | [Quay.io](https://quay.io/) | Red Hat | Enterprise registry; [Clair vuln scanning](https://docs.redhat.com/en/documentation/red_hat_quay/2.9/html/manage_red_hat_quay/quay-security-scanner). |
| | [Amazon ECR Public Gallery](https://gallery.ecr.aws/) | AWS | Public OCI distribution; [pull by tag or digest](https://docs.aws.amazon.com/AmazonECR/latest/public/docker-pull-ecr-image.html). |