[SOLVED] Forbid npm unpublish on client computer

Forbid npm unpublish on client computer

Hello I would like to know if a special npm configuration could

enable npm publish
disable npm unpublish --force [IDEAL]
disable all npm unpublish commands

I am using Verdaccio as a private package repository, and I know that they are working on a special configuration that can achieve this. But does that feature/configuration exist already on client computer using npm ?

Solution

This feature is available in Verdaccio since v4.0.0-alpha.5

https://github.com/verdaccio/verdaccio/blob/4.x/CHANGELOG.md#features

For instance

 'vue':
    access: $all
    publish: $authenticated
    unpublish: admin
    proxy: npmjs

We are introducing a new property called unpublish to be able to handle such a situation. For backward compatibility, if unpublish is not defined will be relying on publish as it works in previous versions.

For more info check our docs

https://verdaccio.org/docs/en/packages#unpublishing-packages