npm packages in Artifact Registry

An npm repository in Artifact Registry stores npm packages.

Supported clients

• npm
• yarn
• pnpm

Authenticate

Prerequisites:

• The GitLab CLI, version 1.115.0 or later.

Authentication with npm, pnpm, and yarn require the GITLAB_TOKEN to be set. To check if the environment variable is set, run:

echo $GITLAB_TOKEN

If nothing is printed, authenticate with the GitLab CLI to set GITLAB_TOKEN:

glab auth login

1. After the token is set, run:

   glab artifact-registry login --npm --registry <repository_url>

   This writes an _authToken line in ~/.npmrc. Yarn version 2.0 and later read npmAuthToken in .yarnrc.yml. Copy the token there.

2. In ~/.npmrc, add your own registry= line, or a @scope:registry= line for a scoped package. Point it at the same URL.

To refresh the token, run the login command again before the token expires. The token lasts 15 minutes by default, and up to 12 hours if you request a longer duration.

Configure your client

An npm repository is available at:

https://<registry_host>/<registry_handle>/npm/<repository_name>/

This URL has the following placeholders:

• <registry_host>: Enter the hostname from your repository’s setup instructions. To find it, go to your repository and select More actions > View setup instructions.
• <registry_handle>: Enter your organization’s registry handle.
• <repository_name>: Enter the name of your repository.

Do not delete the trailing slash at the end of the npm repository URL.

Republishing a version

• npm rejects a version that already exists, with 409.
• Unlike npmjs.com, a hosted repository applies no 24-hour window after publishing.
• An unpublished version number can be used again.

Limits

For the full list of limits, see Artifact Registry limits.

Delete an npm package

• npm unpublish removes a single version or a whole package.
• The Management API also deletes packages, versions, files, and dist-tags.
• Unpublishing marks a package for removal rather than removing it at once. A repository delete that requires an empty repository keeps failing until the removal finishes.

For specific steps, see Artifact Registry API.

Commands that do not work

• npm search returns no results. The registry does not implement search.
• npm audit returns no advisories. The registry does not implement the audit endpoints.
• Both return a not-found response deliberately, so npm install keeps working.