A private npm registry and npm proxy

registry=https://packages.example.com/
//packages.example.com/:_authToken=${NPM_TOKEN}

npm install resolves as it always does among the versions the rules allow, and the resolved addresses in package-lock.json point at your box, so npm ci rebuilds from the lockfile through it too, with npm checking every tarball against the integrity the lockfile recorded. pnpm, Yarn classic and Berry, and Bun work the same way.

Tarballs are cached on disk once, under their SHA-256, and checked against what npm published. Metadata is filtered on the way out, never in the cache. Stale metadata is served for as long as you say when npm is down.

Publishing

Reserve your scope, give your CI account the publisher role, and npm publish. Each publish adds exactly one version and its tarball must match its manifest. A published version never changes and is never removed: republishing and npm unpublish are refused, while npm deprecate and npm dist-tag work. A new version starts in quarantine until its malware scan comes back clean.