One registry URL for npm, yarn and pnpm. Public packages come through a pull-through cache that verifies every checksum; your own packages publish with a scoped token; the policy gate decides what reaches a build.
npm keeps the registry and the token in its own config, so there is nothing to edit by hand. Scope it to one project with --location=project.
The placeholders are your base URL and a token from the web UI. The guide covers the same steps for a single project, plain HTTP, verifying the change, and reverting it.
npm config set registry https://repo.example.com/npm/
npm config set //repo.example.com/npm/:_authToken <your token>The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
The npm guide continues with a verification step, publishing your own packages, and reverting the configuration if you need to.