can you host a private repository for your organiz

Question

Npm sounds like a great platform to use within an organization, curious if a private repo is possible, like with Nexus/Maven. Nothing comes up on Google :(

Answer 1

I don't think there is an easy way to do this.

A look at the npm documentation tells us, that it is possible:

Can I run my own private registry?

Yes!

The easiest way is to replicate the couch database, and use the same (or similar) design doc to implement the APIs.

If you set up continuous replication from the official CouchDB, and then set your internal CouchDB as the registry config, then you'll be able to read any published packages, in addition to your private ones, and by default will only publish internally. If you then want to publish a package for the whole world to see, you can simply override the --registry config for that command.

There's also an excellent tutorial on how to create a private npm repository in the clock blog.

EDIT (2017-02-26):

Not really new, but there are now paid plans to host private packages on NPM.

Over the years, NPM has become a factor for many non-Node.js companies, too, through the huge frontend ecosystem that's built upon NPM. If your company is already running Sonatype Nexus for hosting Java projects internally, you can also use it for hosting internal NPM packages.

Other options include JFrog Artifactory and Inedo ProGet, but I haven't used those.

Answer 2

On 14th of April (2015), npm private modules were introduced.

When you pay for private modules, you can:

• Host as many private packages as you want
• Give read access or read-write access for those packages to any other paid user
• Install and use any packages that other paid users have given you read access to
• Collaborate on any packages that other paid users have given you write access to

Of course it's not free - currently 7$ a month, per user.

And it's still a pretty new service. For example support for organization accounts is missing (as of June 2015):

Currently, private packages are only available for individual users, but support for organization accounts is coming soon. Feel free to create a user for your organization in the meantime, and we can upgrade it to an organization when support is here.

So while not perfect, it's the official npm solution to maintaining private packages, and that itself makes it worth mentioning.

UPDATE

Npm Private Packages are now available, with plans for both individual users and organizations:

• Unlimited number of public & private packages
• $7/month/developer
• Includes one scope name, based on organization name
• Publish and control access to @org-name/foo

(disclaimer: not even remotely affiliated in any way with npm, Inc.)

Answer 3

There is an easy to use npm package to do this. https://www.npmjs.org/package/sinopia

In a nutshell, Sinopia is a private/caching npm repository server that you can setup with zero configuration.

Sinopia can be used to :

• publish own private packages without exposing it to the public
• cache only public packages that are used (there is no need to have to replicate the whole public registery)
• override public packages with a modified version that have been produced internally.

Answer 4

Repository managers with support for private npm registries:

• Sonatype Nexus 2.10
• Artifactory 3.2

Answer 5

Forgive me if I don't understand your question well, but here's my answer:

You can create a private npm module and use npm's normal commands to install it. Most node.js users use git as their repository, but you can use whatever repository works for you.

1. In your project, you'll want the skeleton of an NPM package. Most node modules have git repositories where you can look at how they integrate with NPM (the package.json file, I believe is part of this and NPM's website shows you how to make a npm package)
2. Use something akin to Make to make and tarball your package to be available from the internet or your network to stage it for npm install downloads.

3. Once your package is made, then use

   npm install *tarball_url*

Answer 6

Verdaccio is what I was looking for and it deserves it's own answer ;) It is an actively maintained fork of Sinopia (highly upvoted answer here). It is a npm registry as a npm package, and can be found here: https://github.com/verdaccio/verdaccio, here: https://www.verdaccio.org, or here: pnpm i verdaccio.