NPM Avoid Public Repositories

Some organizations may have the policy of using private repositories only, with a carefully curated approach to load dependencies into their private repository from the public repositories.

This detector checks if in the configuration there is a public repository configured. Or only has the private repositories configured.

The public repositories configured to check are:

you can change, to add or remove repositories, in the public-repositories parameter. You can configure private repositories, in the private-repositories parameter.

Organizations have the policy of restricting packages to private inner repositories for security reasons. For example, to avoid download newer package versions or packages that have not been checked by the security team.

You can change the registry property with

command.