Dependably Packages · npm

A private npm registry you host yourself

One registry URL for npm, yarn and pnpm. Public packages come through a pull-through cache that verifies every checksum; your own packages publish with a scoped token; the policy gate decides what reaches a build.

npm · yarn · pnpm

Point npm at your registry

npm keeps the registry and the token in its own config, so there is nothing to edit by hand. Scope it to one project with --location=project.

The placeholders are your base URL and a token from the web UI. The guide covers the same steps for a single project, plain HTTP, verifying the change, and reverting it.

bash · repo.example.com
npm config set registry https://repo.example.com/npm/
npm config set //repo.example.com/npm/:_authToken <your token>

What happens to every fetch

The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.

  • The checksum is verified against the digest the upstream publishes before the artefact is stored.
  • The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
  • A name your organization reserves cannot be squatted upstream and resolved into your builds.
  • Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.

Verify, publish, revert

The npm guide continues with a verification step, publishing your own packages, and reverting the configuration if you need to.