Private npm registry setup with rvs

Ravenstash gives npm projects a private, authenticated registry without asking developers to maintain token-bearing .npmrc files. The rvs CLI selects the repository and supplies temporary authentication to the client it launches.

Before you start

You need a Ravenstash repository with npm enabled, an npm package, and an authenticated rvs profile:

rvs auth login --profile work
rvs account use org:acme
rvs art select platform/packages

Install a private package

rvs art select platform/packages
rvs npm install @acme/design-system

The selected target determines the private registry. Ravenstash credentials are limited to the child process and do not need to be committed to the project.

Inspect and publish

Review the tarball contents, then publish to the selected repository:

rvs art select platform/packages
rvs npm pack --dry-run
rvs npm publish

After publishing, open the package in Ravenstash and install the exact version in a clean project. This verifies both publication and retrieval before the package enters a release pipeline.

Use a private npmjs.org mirror

Connect the official npmjs.org mirror when the project also needs public dependencies. The same Ravenstash target can resolve private and approved public packages while security scanning, minimum package age, and caching protect the path into developer machines and CI.

This single-source approach also reduces dependency-confusion risk: builds do not have to choose independently between a private registry and npmjs.org when the same package name exists in both places.

CI setup

Store an organization-owned automation token as the protected RVS_TOKEN CI secret, install rvs, and run the same explicit commands:

rvs art select platform/packages
rvs npm ci
rvs npm pack --dry-run
rvs npm publish

Troubleshooting

If npm returns 401 or 403, run rvs auth whoami, confirm the selected account, and verify that platform/packages belongs to that account. If a public dependency is missing, review the connected mirror and its minimum package-age setting.

For the complete workflow, see the npm quickstart, install reference, and publish reference.