Hey Evan! I love this and am working on getting a hold set up in my homelab.
This got me thinking. Before I knew atcr existed I registered registries.social with the same basic idea, but also to eventually take on NPM, PyPI, RubyGems, etc. kinda like GitHub Packages. I think hold could be an excellent starting point, and I may fork this to do a POC with NPM. If it bears fruit, would you be interested in an upstream contribution?