Download NPM packages using direct repository access

Premium and Enterprise (Deprecated) service tiers (requires organization-level activation)

The Security Command Center Enterprise service tier will shut down on May 21, 2027. If your organization uses the Enterprise service tier, then the organization will automatically move to the Premium service tier on or after May 21, 2027. Contact your account representative or a Google Cloud sales specialist if you have questions.

After you integrate Assured OSS with Security Command Center, Assured Open Source Software packages are hosted in an Artifact Registry repository that is created in a project that you control.

This document explains how you can connect to the Artifact Registry repository for Assured OSS to directly access and download JavaScript (NPM) packages.

This document applies to the Assured OSS premium tier only.

Before you begin

1. To get the permissions that you need to get the base64-encoded string of the service account key, ask your administrator to grant you the Service Account Key Admin (roles/iam.serviceAccountKeyAdmin) IAM role on your organization. For more information about granting roles, see Manage access to projects, folders, and organizations.

   You might also be able to get the required permissions through custom roles or other predefined roles.

2. Integrate Assured OSS with Security Command Center.
3. Validate connectivity to Security Command Center for the requested service accounts.
4. Install Node.js and npm on your local machine.
5. Install the latest version of the Google Cloud CLI.

6. If you've installed the Google Cloud CLI previously, check that you have the latest version by running this command:

   gcloud components update

Set up authentication

To set up authentication for Node.js (NPM), configure .npmrc to authenticate with Artifact Registry using service account credentials or Google Cloud user credentials.

Note: If you are using the credential helper to authenticate with an access token, obtain a new token.

For more information, see Set up authentication for Node.js.

Download NPM packages

1. In your .npmrc file, set the registry URL for your JavaScript (NPM) packages:

   registry=https://us-npm.pkg.dev/PROJECT_ID/assuredoss-javascript/
   

   Replace PROJECT_ID with the ID of the project that you selected when you set up Assured OSS.

2. Install the required NPM packages by using npm or yarn:

   • npm:

     npm install package-name
     

   • yarn:

     yarn add package-name
     

   Replace package-name with your package name or scoped package name (for example, express or @scope/package-name).

What's next

• Access security metadata and verify packages in the premium tier
• Review the list of supported NPM packages