JavaScript on

Chainguard Libraries for JavaScript overview

Thu, 05 Jun 2025 09:00:00 +0000

Chainguard Libraries for JavaScript is a major ecosystem supported by Chainguard Libraries. The JavaScript ecosystem consists of thousands of open source projects from the communities around JavaScript, TypeScript, Node.js, React, Vue.js, Angular, Svelte, Next.js, Express, and many others.

Chainguard Libraries for JavaScript provides access to a growing collection of popular Javascript packages rebuilt from source. New releases of packages requested by customers are built and added to the index by an automated system. These libraries can also be consumed through the Chainguard Repository, which provides a single endpoint for package retrieval and supports configurable security policies for both Chainguard-built and upstream packages.

Global configuration

Thu, 05 Jun 2025 09:00:00 +0000

JavaScript and npm package consumption in a large organization is typically managed by a repository manager. Commonly used repository manager applications are JFrog Artifactory, Sonatype Nexus Repository, and others. The repository manager acts as a single point of access for developers and development tools to retrieve the required libraries.

If your organization uses the upstream fallback feature of Chainguard Repository, you can configure your repository manager with a single upstream pointed at https://libraries.cgr.dev/javascript/. This is the recommended setup. The Chainguard Repository handles fallback and policy enforcement; your repository manager handles local caching and access control. Chainguard also retrieves packages from the public npm Registry on your behalf when upstream fallback is enabled. This includes protections such as malware detection and a cooldown period for newly published packages.

Build configuration

Thu, 05 Jun 2025 09:00:00 +0000

The configuration for the use of Chainguard Libraries depends on your build tools, continuous integration, and continuous deployment setups. This page is a configuration reference for each supported JavaScript build tool. It covers registry configuration, authentication, cache clearning, and minimal example projects for npm, pnpm, Yarn, and Bun. The changes described on this page must be performed on all workstations of individual developers and other engineers running relevant application builds. They must also be performed on any build server such as Jenkins, TeamCity, GitHub or other infrastructure that builds the applications or otherwise downloads and uses relevant libraries.

Migrating a JavaScript Project to Chainguard Libraries

Mon, 01 Jun 2026 00:00:00 +0000

Chainguard Libraries for JavaScript provides a curated registry of npm packages rebuilt from source, scanned for malware, and verified against the OSV database. Because Chainguard Libraries uses the standard npm registry protocol, switching an existing project requires only a registry configuration change — no changes to your application code, package.json, or dependency versions.

This guide walks through migrating an existing JavaScript project to Chainguard Libraries, covering the two most common setups: