[Feature Request] - Add "registry" field to package.json for forcing installation from private registries

[Jakobud]

I have a project that I want to distribute to users. The project requires the installation of a variety of standard packages from npmjs.com like a typical project.

However I am also hosting my own private repository (using Verdaccio) and I have multiple custom private packages/modules that the users need to install as well.

Currently the only way to do this is by specifying the --registry flag like so:

npm install --registry https://some.custom.registry.project.com

It would be awesome if NPM added a registry value to the package.json so that users could just run npm install and be done with it.

I noticed that npm has already added a publishConfig.registry value for publishing to custom registries. I'm wondering about why there hasn't been a registry value like I am proposing. Is it for security purposes to prevent random packages from tricking people from accidentally install packages from custom repos that have security vulnerabilities added to the packages? I'm assuming that might be the reason but I don't know for sure.

If this is the reason why this feature will never be implemented just let me know. Thanks,

[ljharb]

You may be referring to https://github.com/npm/rfcs/blob/9450f614d821b98b9ff8612574befc969f84df5c/accepted/0035-registry-spec.md?

[Jakobud]

Similar but not quite. That spec is referring to specifying a registry host in each dependency URL. I'm referring to the idea that there is a "registry" option in the package.json. So for example:

{
  "name": "my-awesome-package",
  "version": "1.0.0",
  "author": "Your Name <[email protected]>",
  "devDependencies": {
        "mocha": "~3.1",
    },
    "dependencies": {
        "resolve": "~1.1.7"
    },
    "registry": "https://mycustom.registrysite.com"
}

So the idea is when I want to install my dependencies, it would not install them from npmjs.com but rather it would install them from my proxy https://mycustom.registrysite.com.

Currently, you have to add the --registry <url> to your commands. My idea would make it so that you don't have to specify the registry.

But I also just realized that I can just specify a .npmrc in the directory and that works too.

[ljharb]

For dev deps, the proper way is indeed a .npmrc and confining private registry packages to being under a finite list of scopes.

For a dep such as resolve, it should never be installed from "not the public registry, or a private registry explicitly intended to be a mirror for it", since it's published to the public registry, and your private packages should thus be scoped (to a scope you own on the public registry). That way, you'd depend on them in your package.json with registry: and it'd be automatic.