deprecate-totp-2fa
@reggi/path-to-regexp
dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2
dependabot/npm_and_yarn/main/eslint-10.4.0
dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0
dependabot/npm_and_yarn/main/proc-log-7.0.0
dependabot/npm_and_yarn/npm_and_yarn-826852524d
dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2
deprecate-totp-2fa
dhei/classic-tokens
gat-bypass-2fa-docs
jpg619/fix-accessibility-content-flow
jpg619/version-bump-tar-2
kartykp/gat-bypass-2fa-docs
kartykp/upgrade-path-to-regex
main
maitxn/version-bump-tar
patch-1
reggi/cache-based-on-version
reggi/dev-engines
reggi/fix-transform-prettier
reggi/overrides
update-search-sensitivity
| 1 | --- |
| 2 | title: Creating and publishing private packages |
| 3 | redirect_from: |
| 4 | - /private-modules/intro |
| 5 | --- |
| 6 | |
| 7 | import shared from '~/shared.js' |
| 8 | |
| 9 | To share your code with a limited set of users or teams, you can publish private user-scoped or organization-scoped packages to the npm registry. |
| 10 | |
| 11 | For more information on scopes and private packages, see "[About scopes][scopes]" and "[About private packages][private-pkgs]". |
| 12 | |
| 13 | <Note> |
| 14 | |
| 15 | **Note:** Before you can publish private user-scoped npm packages, you must [sign up](https://npmjs.com/signup) for a paid npm user account. |
| 16 | |
| 17 | Additionally, to publish private organization-scoped packages, you must [create an npm user account](https://npmjs.com/signup), then [ create a paid npm organization](https://www.npmjs.com/signup?next=/org/create). |
| 18 | |
| 19 | </Note> |
| 20 | |
| 21 | ## Creating a private package |
| 22 | |
| 23 | 1. If you are using npmrc to [manage accounts on multiple registries][reg-config], on the command line, switch to the appropriate profile: |
| 24 | |
| 25 | ``` |
| 26 | npmrc <profile-name> |
| 27 | ``` |
| 28 | |
| 29 | 2. On the command line, create a directory for your package: |
| 30 | |
| 31 | ``` |
| 32 | mkdir my-test-package |
| 33 | ``` |
| 34 | |
| 35 | 3. Navigate to the root directory of your package: |
| 36 | |
| 37 | ``` |
| 38 | cd my-test-package |
| 39 | ``` |
| 40 | |
| 41 | 4. If you are using git to manage your package code, in the package root directory, run the following commands, replacing `git-remote-url` with the git remote URL for your package: |
| 42 | |
| 43 | ``` |
| 44 | git init |
| 45 | git remote add origin git://git-remote-url |
| 46 | ``` |
| 47 | |
| 48 | 5. In the package root directory, run the `npm init` command and pass the scope to the `scope` flag: |
| 49 | - For an organization-scoped package, replace `my-org` with the name of your organization: |
| 50 | |
| 51 | ``` |
| 52 | npm init --scope=@my-org |
| 53 | ``` |
| 54 | |
| 55 | - For a user-scoped package, replace `my-username` with your username: |
| 56 | ``` |
| 57 | npm init --scope=@my-username |
| 58 | ``` |
| 59 | |
| 60 | 6. Respond to the prompts to generate a [`package.json`](https://docs.npmjs.com/about-package-json-and-package-lock-json-files) file. For help naming your package, see "[Package name guidelines][pkg-name]". |
| 61 | |
| 62 | 7. Create a [README file][readme-file] that explains what your package code is and how to use it. |
| 63 | |
| 64 | 8. In your preferred text editor, write the code for your package. |
| 65 | |
| 66 | ## Reviewing package contents for sensitive or unnecessary information |
| 67 | |
| 68 | Publishing sensitive information to the registry can harm your users, compromise your development infrastructure, be expensive to fix, and put you at risk of legal action. **We strongly recommend removing sensitive information, such as private keys, passwords, [personally identifiable information][pii] (PII), and credit card data before publishing your package to the registry.** Even if your package is private, sensitive information can be exposed if the package is made public or downloaded to a computer that can be accessed by more users than intended. |
| 69 | |
| 70 | For less sensitive information, such as testing data, use a `.npmignore` or `.gitignore` file to prevent publishing to the registry. For more information, see [this article][developers]. |
| 71 | |
| 72 | ## Testing your package |
| 73 | |
| 74 | To reduce the chances of publishing bugs, we recommend testing your package before publishing it to the npm registry. To test your package, run `npm install` with the full path to your package directory: |
| 75 | |
| 76 | ``` |
| 77 | npm install my-package |
| 78 | ``` |
| 79 | |
| 80 | ## Publishing private packages |
| 81 | |
| 82 | By default, scoped packages are published with private visibility. |
| 83 | |
| 84 | 1. On the command line, navigate to the root directory of your package. |
| 85 | |
| 86 | ``` |
| 87 | cd /path/to/package |
| 88 | ``` |
| 89 | |
| 90 | 2. To publish your private package to the npm registry, run: |
| 91 | |
| 92 | ``` |
| 93 | npm publish |
| 94 | ``` |
| 95 | |
| 96 | 3. To see your private package page, visit https://npmjs.com/package/*package-name*, replacing *package-name\* with the name of your package. Private packages will say `private` below the package name on the npm website. |
| 97 | |
| 98 | <>{shared['organization-package-private'].image}</> |
| 99 | |
| 100 | For more information on the `publish` command, see the [CLI documentation][cli-publish]. |
| 101 | |
| 102 | [scopes]: about-scopes |
| 103 | [private-pkgs]: about-private-packages |
| 104 | [user-signup]: https://www.npmjs.com/signup |
| 105 | [create-org]: https://www.npmjs.com/signup?next=/org/create |
| 106 | [pkg-name]: package-name-guidelines |
| 107 | [readme-file]: about-package-readme-files |
| 108 | [developers]: /misc/developers#keeping-files-out-of-your-package |
| 109 | [cli-publish]: /cli/publish |
| 110 | [reg-config]: configuring-your-registry-settings-as-an-npm-enterprise-user#using-npmrc-to-manage-multiple-profiles-for-different-registries |
| 111 | [pii]: https://en.wikipedia.org/wiki/Personally_identifiable_information |