Private Package Registries

Connect a private package source so Nullify can resolve dependency metadata and supported package operations for repositories that use it. Package-registry connections are separate from container image scanning and source-control access.

Setup

GitHub Packages (npm) is the only package-registry connector currently available in the Settings → Connectors user interface. Open its card, provide the scope, machine-user credentials, and test package, then select Connect.

Configure the other registry types through the Admin API:

1. Use GET /admin/integrations/catalog to identify the provider, capability, and required fields available to your tenant.

2. Create a connection with POST /admin/integrations/{providerId}/{capability}/connections. Put the chosen catalog entry's configuration and credential values inside a fields object, using its exact schema keys; displayName is optional alongside fields. Endpoint and credential keys differ by provider. Create separate connections for distinct registry origins or ecosystems.

3. List connections with GET /admin/integrations/connections. When the connector supports it, test a saved connection with POST /admin/integrations/connections/{connectionId}/test.

4. Rotate a credential with PUT /admin/integrations/connections/{connectionId}/rotate, wrapping the replacement field values in a fields object. Disconnect with DELETE /admin/integrations/connections/{connectionId}.

5. Re-run the affected dependency workflow and check that private packages resolve. A successful connection test does not prove every package is accessible.

Connector	Configuration
Private npm	Registry URL, read token, optional @scope. An optional ecosystem default covers packages without a more specific scope/origin match.
Private Maven	Repository URL, username, and password or API token.
Private PyPI	PEP 503 index URL, username, and password/token. Use the index's required token username, often __token__.
Private Go proxy	Proxy URL, private module pattern, token, and optional basic-auth username. The private pattern identifies modules that bypass public proxy/checksum services.
Artifactory packages	Base URL, repository key, ecosystem, and the credential fields shown by the connector. Use one connection per ecosystem/repository.
Nexus packages	Base URL, repository name, ecosystem, and the Name Code/Pass Code pair from a Nexus user token. The Name Code is not your login username.
AWS CodeArtifact	An existing AWS cloud connection, domain, domain-owner account ID, region, repository, and ecosystem. Nullify obtains a short-lived authorization token at use time.
GitHub Packages (npm)	Scope, dedicated machine-user username, classic PAT, and a real private test package. An optional package-origin override supports the configured enterprise host.

At most one connection per ecosystem should be the default. Prefer explicit origins or scopes where multiple registries are used. Rotating a connection should preserve its intended package scope.

GitHub Packages credentials

This connector requires a classic PAT with read:packages from a dedicated machine user. It does not accept GitHub App installation tokens or fine-grained PATs. Your existing GitHub App connection does not supply this package credential.

Give the machine user access to the private test package and authorize it for organization SSO when required. Nullify validates the credential by reading that package on connect and rotation; failed validation does not replace a working stored credential. Use the package origin shown for your GitHub environment rather than assuming the public npm host applies.

API lifecycle

The API lifecycle above supports multiple connection instances for a registry. See the Admin API. Do not place credentials in repository configuration, URLs, or support screenshots.