One essential requirement for my project is to have a module that can download a private npm package. In order to achieve this, I have set up a .npmrc file where a read-only token is required to be supplied for the package download. To maintain security and prevent the npm-supplied token from being exposed in the file, I intend to add it as an environment variable and let it dynamically expand in the file. For example:
# .npmrc
//registry.npmjs.org/:_authToken=${NPM_TOKEN}
However, I am facing difficulties in ensuring that the NPM_TOKEN is added to the environment before it is referenced for installation. Even after attempting to use an npm preinstall script like this:
"preinstall": "NPM_READ_ONLY_TOKEN=my_token_goes_here_foo_bar"I continue to encounter the same error:
Error: Failed to replace env in config: ${NPM_READ_ONLY_TOKEN}
In an effort to troubleshoot, I tested using an echo command to see if the preinstall script runs before the .npmrc variable expansion, but it seems that the echo log does not appear due to the error message. It appears that there may be something missing in my approach.
Moreover, I understand that storing my token directly in the package.json would defeat the purpose of separating the token from the .npmrc file. Instead, I am considering utilizing a service that offers environmental configuration services to fetch the necessary token through a command execution. For instance, TOKEN=config_service_value.