@cryptotaxi247 / documentation
Code Commits Issues Pulls Sessions CI/CD
dependabot/npm_and_yarn/main/proc-log-7.0.0
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 165 lines 6.64 KB
Raw
1 ---
2 title: Creating and publishing private packages
3 redirect_from:
4 - /private-modules/intro
5 ---
6
7 import shared from '~/shared.js'
8
9 To share your code with a limited set of users or teams, you can publish private user-scoped or organization-scoped packages to the npm registry.
10
11 For more information on scopes and private packages, see "[About scopes][scopes]" and "[About private packages][private-pkgs]".
12
13 <Note>
14
15 **Note:** Before you can publish private user-scoped npm packages, you must [sign up](https://npmjs.com/signup) for a paid npm user account.
16
17 Additionally, to publish private organization-scoped packages, you must [create an npm user account](https://npmjs.com/signup), then [ create a paid npm organization](https://www.npmjs.com/signup?next=/org/create).
18
19 </Note>
20
21 ## Creating a private package
22
23 1. If you are using npmrc to [manage accounts on multiple registries][reg-config], on the command line, switch to the appropriate profile:
24
25 ```
26 npmrc <profile-name>
27 ```
28
29 2. On the command line, create a directory for your package:
30
31 ```
32 mkdir my-test-package
33 ```
34
35 3. Navigate to the root directory of your package:
36
37 ```
38 cd my-test-package
39 ```
40
41 4. If you are using git to manage your package code, in the package root directory, run the following commands, replacing `git-remote-url` with the git remote URL for your package:
42
43 ```
44 git init
45 git remote add origin git://git-remote-url
46 ```
47
48 5. In the package root directory, run the `npm init` command and pass the scope to the `scope` flag:
49 - For an organization-scoped package, replace `my-org` with the name of your organization:
50
51 ```
52 npm init --scope=@my-org
53 ```
54
55 - For a user-scoped package, replace `my-username` with your username:
56 ```
57 npm init --scope=@my-username
58 ```
59
60 6. Respond to the prompts to generate a [`package.json`](https://docs.npmjs.com/about-package-json-and-package-lock-json-files) file. For help naming your package, see "[Package name guidelines][pkg-name]".
61
62 7. Create a [README file][readme-file] that explains what your package code is and how to use it.
63
64 8. In your preferred text editor, write the code for your package.
65
66 ## Reviewing package contents for sensitive or unnecessary information
67
68 Publishing sensitive information to the registry can harm your users, compromise your development infrastructure, be expensive to fix, and put you at risk of legal action. **We strongly recommend removing sensitive information, such as private keys, passwords, [personally identifiable information][pii] (PII), and credit card data before publishing your package to the registry.** Even if your package is private, sensitive information can be exposed if the package is made public or downloaded to a computer that can be accessed by more users than intended.
69
70 For less sensitive information, such as testing data, use a `.npmignore` or `.gitignore` file to prevent publishing to the registry. For more information, see [this article][developers].
71
72 ## Testing your package
73
74 To reduce the chances of publishing bugs, we recommend testing your package before publishing it to the npm registry. To test your package, run `npm install` with the full path to your package directory:
75
76 ```
77 npm install my-package
78 ```
79
80 ## Publishing private packages
81
82 By default, scoped packages are published with private visibility.
83
84 There are two ways to publish your package to the npm registry:
85
86 1. [Direct publishing](#direct-publishing)
87 2. [Staged publishing](#staged-publishing)
88
89 ### Direct publishing
90
91 To publish directly with `npm publish`, you need either:
92
93 - Two-factor authentication (2FA) enabled on your account, or
94 - A granular access token (GAT) with bypass 2FA enabled
95
96 For more information, see the npm documentation on [requiring 2FA for package publishing](/requiring-2fa-for-package-publishing-and-settings-modification).
97
98 1. On the command line, navigate to the root directory of your package.
99
100 ```
101 cd /path/to/package
102 ```
103
104 2. To publish your private package to the npm registry, run:
105
106 ```
107 npm publish
108 ```
109
110 3. To see your private package page, visit https://npmjs.com/package/*package-name*, replacing *package-name\* with the name of your package. Private packages will say `private` below the package name on the npm website.
111
112 <>{shared['organization-package-private'].image}</>
113
114 For more information on the `publish` command, see the [CLI documentation][cli-publish].
115
116 ### Staged publishing
117
118 Instead of publishing directly, you can stage your package and approve it later. Staging the package does not require 2FA, which allows CI workflows to submit a package to the staging area. Before the package is published to the registry, a maintainer must review and approve it with 2FA.
119
120 A GAT with bypass 2FA does not bypass the 2FA check during staged package approval.
121
122 1. On the command line, navigate to the root directory of your package.
123
124 ```
125 cd /path/to/package
126 ```
127
128 2. To stage your package, run:
129
130 ```
131 npm stage publish
132 ```
133
134 This submits your package to a staging area.
135
136 3. To check that your package has been staged, use either of the following methods:
137 - In the CLI, run `npm stage list <package-name>` to find the staged package and its stage ID.
138 - On [npmjs.com](https://www.npmjs.com), open the **Staged Packages** tab to review staged packages.
139
140 4. To approve and publish the staged package, use one of the following methods:
141 - In the CLI, run the `npm stage approve <stage-id>` command.
142 - On [npmjs.com](https://www.npmjs.com), review the staged package in the **Staged Packages** tab, then click **Approve**.
143
144 <Note>
145
146 **Note:** You will be prompted for 2FA verification regardless of whether you approve the package in the CLI or on [npmjs.com](https://www.npmjs.com). Once approved, the package is published to the live registry.
147
148 </Note>
149
150 For the full staged publishing workflow, including reviewing, inspecting, and rejecting staged packages, see [Staged publishing][staged-publishing].
151
152 [scopes]: about-scopes
153 [private-pkgs]: about-private-packages
154 [user-signup]: https://www.npmjs.com/signup
155 [create-org]: https://www.npmjs.com/signup?next=/org/create
156 [pkg-name]: package-name-guidelines
157 [readme-file]: about-package-readme-files
158 [developers]: /misc/developers#keeping-files-out-of-your-package
159 [cli-publish]: /cli/publish
160 [reg-config]: configuring-your-registry-settings-as-an-npm-enterprise-user#using-npmrc-to-manage-multiple-profiles-for-different-registries
161 [pii]: https://en.wikipedia.org/wiki/Personally_identifiable_information
162 [config-2fa]: /configuring-two-factor-authentication
163 [creating-token]: /creating-and-viewing-access-tokens
164 [requiring-2fa]: /requiring-2fa-for-package-publishing-and-settings-modification
165 [staged-publishing]: /staged-publishing