depwall/
/

    Home / Docs / Configure

    Private registries

    Point DepWall at an internal mirror so a lockfile from it does not resolve to ASK.

    If your organisation uses an internal mirror, list its hosts once:

    $ export DEPWALL_REGISTRY_ALLOWLIST=npm.corp.example.com,npm.pkg.github.com

    Without it, a lockfile pointing at an unrecognised host resolves to ASK — deliberate, since that is also what a poisoned lockfile looks like. Listed hosts may also serve plain HTTP for localhost mirrors, but HTTP pointed at a public registry still asks.