npmrc

To configure npm for GitHub Packages, you generate per-scope registry mappings in your project .npmrc that direct organization scopes to the GitHub Packages URL. This ensures npm install commands resolve scoped packages to the correct registry without embedding credentials.

Your npm token leaks into source control when authentication credentials are stored in the project-level .npmrc. To prevent token leakage, keep authentication tokens in the user-level ~/.npmrc and only store per-scope registry mappings in the project directory.

The correct .npmrc format for mapping an organization scope uses the @scope:registry=https://registry-url/ syntax. This configuration redirects npm to fetch packages published under that specific scope from the designated GitHub Packages registry instead of the default npm registry.

Yes, you need a personal access token with the read:packages scope to install private component libraries from GitHub Packages. This token must be configured in your user-owned ~/.npmrc file to authenticate registry requests without exposing credentials in the project repository.

Yes, you can set up per-scope registry mappings in CI by generating project-level .npmrc files with only the scope-to-registry URLs, while injecting the read:packages authentication token into the user-level ~/.npmrc through secure CI environment variables.

You should not use a project-level .npmrc for GitHub Packages authentication when it requires storing tokens directly in the file. Storing tokens in project files risks accidental exposure in version control, so authentication should always remain in the user-level ~/.npmrc.