In this lesson, you will learn how to configure your project to pull packages from secure, private enterprise registries instead of the default public npm registry.
Why Use a Private Registry?
In many enterprise environments, companies build internal tools, shared UI components, or sensitive business logic that they do not want to publish to the public web. By using a private registry (like Artifactory, Verdaccio, or npm Enterprise), you keep your proprietary code behind your company's firewall.
However, your project likely still needs libraries from the public npmjs.com registry, such as express or lodash. To handle this, we use an .npmrc file.
Configuring Your .npmrc
The .npmrc file acts as the configuration hub for your package manager. You can place this file in your project root to override default behaviors.
If your company has a private registry for their own packages (e.g., packages starting with @acme), you can map those specific scopes to your private URL while letting everything else go to the public registry.
Add these lines to your .npmrc:
# Direct all @acme scoped packages to our private server
@acme:registry=https://npm.acme.corp/
# Set the registry for all other (public) packages
registry=https://registry.npmjs.org/
Managing Authentication
Because your private registry is protected, you must authenticate. You should never commit credentials directly into your project files. Instead, use environment variables to inject your auth token into the .npmrc.
Inside your .npmrc, you can reference an environment variable like this:
//npm.acme.corp/:_authToken=${NPM_TOKEN}
By doing this, your CI/CD pipeline or local development environment will pick up the secret NPM_TOKEN from your shell or secret manager (as discussed in our earlier sessions on Secret Management) and inject it into the registry request automatically. This allows you to maintain a clean separation between public open-source dependencies and your private internal intellectual property.
Key Takeaway: Use an .npmrc file to route specific package scopes to internal servers while keeping public dependencies pointed at the standard registry, ensuring your sensitive code stays secure.