Private npm registry setup with rvs

Ravenstash gives npm projects a private, authenticated registry without asking developers to maintain token-bearing .npmrc files. The rvs CLI selects the repository and supplies temporary authentication to the client it launches.

Before you start

You need a Ravenstash repository with npm enabled, an npm package, and an authenticated rvs profile:

rvs auth login --profile work
rvs account switch AcmeHQ
rvs art select platform/packages

Install a private package

rvs art select platform/packages
rvs npm install @acme/design-system

The selected repository determines the private registry. Ravenstash credentials last only for the command and do not need to be committed to the project.

Inspect and publish

Review the tarball contents, then publish to the selected repository:

rvs art select platform/packages
rvs npm pack --dry-run
rvs npm publish

rvs shows the destination and package before uploading. Review them, then confirm the publish.

After publishing, open the package in Ravenstash and install the exact version in a clean project. This verifies both publication and retrieval before the package enters a release pipeline.

Use a private npmjs.org mirror

Connect the official npmjs.org mirror when the project also needs public dependencies. The same Ravenstash target can resolve private and approved public packages while security scanning, minimum package age, and caching protect the path into developer machines and CI.

This single-source approach also reduces dependency-confusion risk: builds do not have to choose independently between a private registry and npmjs.org when the same package name exists in both places. See how upstream package resolution works for the order Ravenstash uses.

CI setup

Store an organization-owned automation token as the protected RVS_TOKEN CI secret, install rvs, and run the same explicit commands:

rvs art select platform/packages
rvs npm ci
rvs npm pack --dry-run
rvs npm --rvs-yes publish

Troubleshooting

If npm returns 401 or 403, run rvs status, confirm the selected account, and verify that platform/packages belongs to that account. If a public dependency is missing, review the connected mirror and its minimum package-age setting.

For the complete workflow, see the npm quickstart, install reference, and publish reference.