Private npm package registries

Enable npm in a Ravenstash repository to publish scoped or unscoped packages and install private JavaScript, TypeScript, Node.js, and WebAssembly packages through an authenticated npm-compatible registry.

Choose a workflow

Complete the npm quickstartEnable npm, publish one package, and install it from the selected Ravenstash repository.

Install npm packagesUse rvs npm or configure an npm-compatible client with temporary credentials.

Publish npm packagesInspect and publish a private package without saving Ravenstash credentials in project files.

Add a protected npm mirrorInstall approved npmjs.org dependencies through an authenticated Ravenstash source.

npm in Ravenstash

Ravenstash serves npm-compatible package metadata, version metadata, and tarballs. It supports authenticated publication and registry configuration for npm-compatible clients. The rvs npm wrapper provides the shortest supported workflow without persisting a registry token in .npmrc.

When one Ravenstash repository supports several formats, npm packages, URLs, usage, and mirror settings remain separate from its PyPI and Maven content.

Upstreams and resolution rules

When the repository connects a npmjs.org mirror or another private repository, its own packages come first and the first upstream that has a name supplies all of its versions. See How upstream package resolution works.

To keep names you own, such as @acme/*, away from public registries, or to combine versions from several sources, add package resolution rules on the repository’s Rules tab.