npm Registry

To enable calculation of npm package metadata in local repositories, in the Administration module, go to Repositories| Repositories | Local and set the Package Type to npm when you create the repository.

Read More:

JFrog Artifactory and npm Registries

How to set up a Private, Remote and Virtual npm Registry

Artifactory allows you to define any layout for your npm registries. In order to upload packages according to your custom layout, you need to package your npm files using the npm pack command. This creates the .tgz file for your package which you can then upload to any path within your local npm repository.

Remote npm Registry

A Remote Repositories defined in Artifactory serves as a caching proxy for a registry managed at a remote URL such as https://registry.npmjs.org. Artifacts (such as TGZ files) requested from a remote repository are cached on demand. You can remove downloaded artifacts from the remote repository cache, however, you can not manually deploy artifacts to a remote npm registry.

To define a remote repository to proxy a remote npm registry:

1. In the Administration module, under Repositories | Repositories | Remote, click New Remote Repository.

2. In the New Remote Repository dialog:

   1. Set the Package Type to npm and the Repository Key value.

   2. Specify the URL to the remote registry in the URL field.

3. Click Save & Finish.

Virtual npm Registry

A Virtual Repository defined in Artifactory aggregates packages from both local and remote repositories.

This allows you to access both locally hosted npm packages and remote proxied npm registries from a single URL defined for the virtual repository.

To define a virtual npm registry:

1. In the Administration module, under Repositories | Repositories | Virtual, click New Virtual Repository.

2. In the New Virtual Repositorydialog, set thePackage Type to npm.

3. Select the underlying local and remote npm registries to include in the Basic settingstab.

4. Click Save & Finish to create the repository.

Advanced Configuration

The fields under External Dependency Rewrite are connected to automatically rewriting external dependencies for npm packages that require them.

Field	Description
Enable Dependency Rewrite	When selected, external dependencies are rewritten.
Remote Repository For Cache	The remote repository aggregated by this virtual repository in which the external dependency will be cached.
Patterns Allow List	An Allow List of Ant-style path expressions that specify where external dependencies may be downloaded from. By default, this is set to ** which means that dependencies may be downloaded from any external source. For example, if you wish to limit external dependencies to only be downloaded fromgithub.com, you should add**github.com**(and remove the default**expression).

To use the npm command line you need to make sure npm is installed. Npm is included as an integral part of recent versions of Node.js.

Please refer to Installing Node.js via package manager on GitHub or the npm README page.

Once you have created your npm repository, you can select it in the Tree Browser and click Set Me Up to get code snippets you can use to change your npm registry URL, deploy and resolve packages using the npm command line tool.

npm config set registry http://<ARTIFACTORY_SERVER_DOMAIN>:8081/artifactory/api/npm/npm-repo/

npm config set @<SCOPE>:registry http://<ARTIFACTORY_SERVER_DOMAIN>:8081/artifactory/api/npm/npm-repo/

npm login

$ curl -uadmin:<CREDENTIAL> http://<ARTIFACTORY_SERVER_DOMAIN>:8081/artifactory/api/npm/auth

_auth = YWRtaW46e0RFU2VkZX1uOFRaaXh1Y0t3bHN4c2RCTVIwNjF3PT0=
email = myemail@email.com
always-auth = true

curl -uadmin:<CREDENTIAL> http://<ARTIFACTORY_SERVER_DOMAIN>:8081/artifactory/api/npm/npm-repo/auth/<SCOPE>

$ npm install request
npm http GET http://localhost:8081/artifactory/api/npm/npm-repo/request
npm http 200 http://localhost:8081/artifactory/api/npm/npm-repo/request
npm http GET http://localhost:8081/artifactory/api/npm/npm-repo/request/-/request-2.33.0.tgz
npm http 200 http://localhost:8081/artifactory/api/npm/npm-repo/request/-/request-2.33.0.tgz

By default, the latest version of a package in an npm registry in Artifactory is the one with the highest SemVer version number. You can override this so that the most recently uploaded package is returned by Artifactory as the latest version. To do so, in Artifactory's system.properties file, add or set:

artifactory.npm.tag.tagLatestByPublish = true

By default, Artifactory allows anonymous access to npm repositories. This is defined in the Admin module under Security | General. For details, please refer to Allow Anonymous Access.Introduction to the General Security Settings

If you want to trace how users interact with your repositories you need to disable the Allow Anonymous Access setting. This means that users will be required to enter their username and password as described in Setting Your Credentials above.Introduction to the General Security Settings

Artifactory uses GitHub Enterprise as its default OAuth provider. If you have an account, you may use your GitHub Enterprise login details to be authenticated when using the npm login command.OAuth SSO

Artifactory supports a variety of ways to search artifacts. For details, please refer to Searching for Artifacts_OLD.

Artifactory also supports npm search [search terms ...]. However, these packages may not be available immediately after being published for the following reasons:

In the case of remote repositories, a new package will only be found once Artifactory checks for it according to the Retrieval Cache Period setting.

The npm client saves cached packages that were downloaded, as well as the JSON metadata responses (named .cache.json ).

The JSON metadata cache files contain URLs which the npm client uses to communicate with the server, as well as other ETag elements sent by previous requests.

We recommend removing the npm caches (both packages and metadata responses) before using Artifactory for the first time. This is to ensure that your caches only contain elements that are due to requests from Artifactory and not directly from https://registry.npmjs.org.

The default cache directory on Windows is %APPDATA%\npm-cache while on Linux it is ~/.npm.

Artifactory fully supports npm scope packages. The support is transparent to the user and does not require any different usage of the npm client.

@jfrog:registry=http://localhost:8081/artifactory/api/npm/npm-local/
//localhost:8081/artifactory/api/npm/npm-local/:_password=cGFzc3dvcmQ=
//localhost:8081/artifactory/api/npm/npm-local/:username=admin
//localhost:8081/artifactory/api/npm/npm-local/:email=myemail@email.com
//localhost:8081/artifactory/api/npm/npm-local/:always-auth=true

$ curl -uadmin:password "http://localhost:8081/artifactory/api/npm/npm-local/auth/jfrog"
@jfrog:registry=http://localhost:8081/artifactory/api/npm/npm-local/
//localhost:8081/artifactory/api/npm/npm-local/:_password=QVA1N05OaHZTMnM5Qk02RkR5RjNBVmF4TVFl
//localhost:8081/artifactory/api/npm/npm-local/:username=admin
//localhost:8081/artifactory/api/npm/npm-local/:email=admin@jfrog.com
//localhost:8081/artifactory/api/npm/npm-local/:always-auth=true

Packages requested by the npm client frequently use external dependencies as defined in the packages' package.json file. These dependencies may, in turn, need additional dependencies. Therefore, when downloading an npm package, you may not have full visibility into the full set of dependencies that your original package needs (whether directly or transitively). As a result, you are at risk of downloading malicious dependencies from unknown external resources.

To manage this risk, and maintain the best practice of consuming external packages through Artifactory, you may specify a "safe" Allow List from which dependencies may be downloaded, cached in Artifactory and configure to rewrite the dependencies so that the npm client accesses dependencies through a virtual repository as follows:

In the following example, the external dependencies are cached in the "npm" remote repository and only the package from https://github.com/jfrogdev is allowed to be cached.

Artifactory supports all possible shorthand resolvers including the following:

git+ssh://user@hostname:project.git#commit-ish
git+ssh://user@hostname/project.git#commit-ish
git+https://git@github.com/<user>/<filename>.git

Artifactory lets you view selected metadata of an npm package directly from the UI.

In the Tree Browser, drill down to select the TGZ file you want to inspect. The metadata is displayed in the npm Info tab.

You may store exhaustive build information in Artifactory by running your npm builds with JFrog CLI.

JFrog CLI collects build-info from your build agents and then publishes it to Artifactory. Once published, the build info can be viewed in the Build Browser under Builds.Build Integration

For more details on npm build integration using JFrog CLI, please refer to Building npm Packages in the JFrog CLI User Guide.