Private Package Management - Complete Guide
Published: September 25, 2024 | Reading time: 19 minutes
Private Package Overview
Private package management provides secure, controlled access to proprietary packages:
Private Package Benefits
# Private Package Benefits
- Secure package distribution
- Access control
- Enterprise compliance
- Internal package sharing
- Version control
- Dependency management
- Team collaboration
NPM Private Packages
NPM Private Registry Setup
NPM Private Packages
# NPM Private Packages
# 1. NPM Private Registry Authentication
npm login --registry=https://npm.company.com
npm whoami --registry=https://npm.company.com
# 2. Configure Private Registry
npm config set registry https://npm.company.com
npm config set @company:registry https://npm.company.com
# 3. Publish Private Package
npm publish --registry=https://npm.company.com
npm publish --access restricted
# 4. Install Private Package
npm install @company/private-package
npm install @company/private-package@1.0.0
# 5. Private Package Configuration
# package.json
{
"name": "@company/private-package",
"version": "1.0.0",
"private": true,
"publishConfig": {
"registry": "https://npm.company.com"
}
}
# 6. Scoped Package Configuration
# .npmrc
@company:registry=https://npm.company.com
//npm.company.com/:_authToken=${NPM_TOKEN}
# 7. Private Package Authentication
# Environment variables
export NPM_TOKEN="your-auth-token"
export NPM_REGISTRY="https://npm.company.com"
# 8. Private Package Installation
npm install @company/private-package --registry=https://npm.company.com
# 9. Private Package Updates
npm update @company/private-package
npm install @company/private-package@latest
# 10. Private Package Unpublish
npm unpublish @company/private-package@1.0.0 --registry=https://npm.company.com
Yarn Private Packages
Yarn Private Registry Configuration
Yarn Private Packages
# Yarn Private Packages
# 1. Yarn Private Registry Authentication
yarn login --registry https://npm.company.com
yarn whoami --registry https://npm.company.com
# 2. Configure Private Registry
yarn config set registry https://npm.company.com
yarn config set @company:registry https://npm.company.com
# 3. Publish Private Package
yarn publish --registry https://npm.company.com
yarn publish --access restricted
# 4. Install Private Package
yarn add @company/private-package
yarn add @company/private-package@1.0.0
# 5. Private Package Configuration
# package.json
{
"name": "@company/private-package",
"version": "1.0.0",
"private": true,
"publishConfig": {
"registry": "https://npm.company.com"
}
}
# 6. Scoped Package Configuration
# .yarnrc
"@company:registry" "https://npm.company.com"
"//npm.company.com/:_authToken" "${NPM_TOKEN}"
# 7. Private Package Authentication
# Environment variables
export NPM_TOKEN="your-auth-token"
export NPM_REGISTRY="https://npm.company.com"
# 8. Private Package Installation
yarn add @company/private-package --registry https://npm.company.com
# 9. Private Package Updates
yarn upgrade @company/private-package
yarn add @company/private-package@latest
# 10. Private Package Unpublish
yarn unpublish @company/private-package@1.0.0 --registry https://npm.company.com
Enterprise Registry Solutions
Private Registry Platforms
Enterprise Registry Solutions
# Enterprise Registry Solutions
# 1. GitHub Packages
# Configure GitHub Packages
npm config set @company:registry https://npm.pkg.github.com
npm config set //npm.pkg.github.com/:_authToken ${GITHUB_TOKEN}
# Publish to GitHub Packages
npm publish --registry https://npm.pkg.github.com
# Install from GitHub Packages
npm install @company/private-package
# 2. GitLab Package Registry
# Configure GitLab Packages
npm config set @company:registry https://gitlab.company.com/api/v4/projects/123/packages/npm
npm config set //gitlab.company.com/api/v4/projects/123/packages/npm/:_authToken ${GITLAB_TOKEN}
# Publish to GitLab Packages
npm publish --registry https://gitlab.company.com/api/v4/projects/123/packages/npm
# Install from GitLab Packages
npm install @company/private-package
# 3. Azure Artifacts
# Configure Azure Artifacts
npm config set @company:registry https://pkgs.dev.azure.com/company/_packaging/feed/npm/registry/
npm config set //pkgs.dev.azure.com/company/_packaging/feed/npm/registry/:_authToken ${AZURE_TOKEN}
# Publish to Azure Artifacts
npm publish --registry https://pkgs.dev.azure.com/company/_packaging/feed/npm/registry/
# Install from Azure Artifacts
npm install @company/private-package
# 4. JFrog Artifactory
# Configure Artifactory
npm config set @company:registry https://artifactory.company.com/artifactory/api/npm/npm-local/
npm config set //artifactory.company.com/artifactory/api/npm/npm-local/:_authToken ${ARTIFACTORY_TOKEN}
# Publish to Artifactory
npm publish --registry https://artifactory.company.com/artifactory/api/npm/npm-local/
# Install from Artifactory
npm install @company/private-package
# 5. Nexus Repository
# Configure Nexus
npm config set @company:registry https://nexus.company.com/repository/npm-private/
npm config set //nexus.company.com/repository/npm-private/:_authToken ${NEXUS_TOKEN}
# Publish to Nexus
npm publish --registry https://nexus.company.com/repository/npm-private/
# Install from Nexus
npm install @company/private-package
Authentication and Security
Security Best Practices
Authentication Methods
- Token-based authentication
- OAuth integration
- SSO integration
- API key management
- Role-based access
- Multi-factor authentication
- Audit logging
Security Best Practices
- Secure token storage
- Regular token rotation
- Access control policies
- Vulnerability scanning
- Encrypted communication
- Audit trail maintenance
- Compliance monitoring
CI/CD Integration
Automated Private Package Management
CI/CD Integration
# CI/CD Integration
# 1. GitHub Actions Private Packages
# .github/workflows/private-packages.yml
name: Private Package Management
on: [push, pull_request]
jobs:
private-packages:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: '18'
- name: Configure Private Registry
run: |
npm config set @company:registry https://npm.company.com
npm config set //npm.company.com/:_authToken ${{ secrets.NPM_TOKEN }}
- name: Install Private Packages
run: npm ci
- name: Publish Package
if: github.ref == 'refs/heads/main'
run: npm publish
# 2. GitLab CI Private Packages
# .gitlab-ci.yml
private_packages:
stage: build
script:
- npm config set @company:registry https://npm.company.com
- npm config set //npm.company.com/:_authToken $NPM_TOKEN
- npm ci
- npm publish
only:
- main
# 3. Jenkins Private Packages
# Jenkinsfile
pipeline {
agent any
stages {
stage('Private Packages') {
steps {
sh 'npm config set @company:registry https://npm.company.com'
sh 'npm config set //npm.company.com/:_authToken $NPM_TOKEN'
sh 'npm ci'
sh 'npm publish'
}
}
}
}
# 4. Azure DevOps Private Packages
# azure-pipelines.yml
trigger:
- main
pool:
vmImage: 'ubuntu-latest'
steps:
- task: NodeTool@0
inputs:
versionSpec: '18.x'
- script: |
npm config set @company:registry https://npm.company.com
npm config set //npm.company.com/:_authToken $(NPM_TOKEN)
npm ci
npm publish
displayName: 'Private Package Management'
# 5. CircleCI Private Packages
# .circleci/config.yml
version: 2
jobs:
private-packages:
docker:
- image: node:18
steps:
- checkout
- run: npm config set @company:registry https://npm.company.com
- run: npm config set //npm.company.com/:_authToken $NPM_TOKEN
- run: npm ci
- run: npm publish
Summary
Private package management involves several key components:
- NPM Private Packages: Authentication, configuration, and publishing
- Yarn Private Packages: Yarn-specific private registry setup
- Enterprise Solutions: GitHub, GitLab, Azure, JFrog, Nexus
- CI/CD Integration: Automated private package management
Need More Help?
Struggling with private package management or need help setting up enterprise registries? Our package management experts can help you implement secure private package solutions.
Get Private Package Help