Dependably Packages · npm
A private npm registry you host yourself
One registry URL for npm, yarn and pnpm. Public packages come through a pull-through cache that verifies each SHA-512 integrity hash the registry publishes; your own packages publish with a scoped token; the policy gate decides what reaches a build.
npm · yarn · pnpm
Point npm at your registry
npm keeps the registry and the token in its own config, so there is nothing to edit by hand. Scope it to one project with --location=project.
The placeholders are your base URL and a token from the web UI.
npm config set registry https://repo.example.com/npm/
npm config set //repo.example.com/npm/:_authToken <your token>What happens to every fetch
The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
- The checksum is verified against the digest the upstream publishes before the artefact is stored.
- The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
- A name your organization reserves cannot be squatted upstream and resolved into your builds.
- Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.
Verify, publish, revert
The npm guide continues with a verification step, publishing your own packages, and reverting the configuration.