Skip to main content
PMG checks packages from the public registries, such as registry.npmjs.org and pypi.org. When your package manager uses an internal mirror or a registry proxy, such as Artifactory, Nexus, or Athens, add the registry to the PMG config. PMG then checks each package that comes from it. PMG checks public packages. A private package that is not in the SafeDep malware database passes the check.

​
Add the registry

1

Find the registry URL your package manager uses

Run npm config get for each scope that you use. For Go, use the GOPROXY URL. For Cargo, read the [registries] and [source] tables of .cargo/config.toml.
2

Add the registry to the PMG config

Open the config file with pmg config edit and add an entry under proxy.registries:
The ecosystem is npm, pypi, go, or cargo. For PyPI, use a URL that ends in /simple. If the registry serves files from a second host, add that URL as a second endpoint.
3

Check the config

The Custom registries row shows the number of endpoints. When an entry is not valid, the row fails, and PMG refuses to run installs until you fix it.
4

Install a package from the registry

The report shows PMG: N packages analyzed.
Do not put credentials in the PMG config. Keep them where your package manager reads them, such as .npmrc or the pip config. PMG does not store them.

​
Next steps

For how PMG matches a request, the requirements for each registry type, and troubleshooting, see Custom Registries in the PMG repository.

Hold Back Newly Published Package Versions

Set the dependency cooldown window.

Limit the Hosts a Package Install Can Reach

Allow an install to reach only your registry.