Usage npm

Usage: npm / yarn

Publishing

Unlike RPM, APK and pacman, npm publishing works directly over HTTP via npm publish/yarn publish — there's no CLI/gRPC-only path here.

npm config set @acme:registry http://silo.internal:8080/myrepo/stable/npm/
npm config set //silo.internal:8080/myrepo/stable/npm/:_authToken silo_xxx...

npm publish --registry http://silo.internal:8080/myrepo/stable/npm/

_authToken is sent as Authorization: Bearer — npm is the only one of the four formats that uses Bearer auth rather than HTTP Basic or a URL-embedded credential. Use a token with write permission scoped to myrepo; write access is never widened by a repo's public mode, unlike reads.

Alternatively via the CLI:

silo publish ./widget-1.0.0.tgz --repo myrepo --channel stable

Consuming — private repo (auth enabled)

npm config set @acme:registry http://silo.internal:8080/myrepo/stable/npm/
npm config set //silo.internal:8080/myrepo/stable/npm/:_authToken silo_xxx...

npm install @acme/widget

Use a token with at least read permission scoped to myrepo.

Consuming — public repo (no auth)

Once the repo is public (silo repo set myrepo --mode=public, see Usage), only the registry needs to be set — no _authToken:

npm config set @acme:registry http://silo.internal:8080/myrepo/stable/npm/
npm install @acme/widget

Signing

There's nothing to sign for npm. Clients verify the integrity hashes embedded in the packument, which silo computes at publish time and serves over TLS.

public_base_url

npm is the one format that strictly needs public_base_url set in the server config (see Setup) — packuments must embed absolute tarball URLs, and without it the server can only derive an address per request from Host/X-Forwarded-*.