JavaScript

SecureChain delivers verified, signed, continuously patched JavaScript packages from a TuxCare-managed npm registry. This page shows how to connect a project to it — with the SecureChain CLI or by hand.

Prerequisites

TuxCare CLN token — contact [email protected]
A JavaScript project with package.json. If you're starting from scratch, run your package manager's init command (npm init -y, pnpm init, yarn init, bun init) in your project directory to create one.

Installation

There are two ways to connect a project to SecureChain. Both lead to the same result: your package manager installs the TuxCare builds from the TuxCare registry.

Option 1: SecureChain CLI — recommended. One tool configures the registry, finds the packages that have a patched build, including transitive ones, pins them and verifies the result.
Option 2: Manual setup — you edit the package manager's configuration yourself and install nothing extra.

Option 1: SecureChain CLI (recommended)

securechain is a single binary that does the work of the manual setup for you. It detects your package manager (npm, pnpm, yarn or bun), points it at the TuxCare registry, compares the whole resolved dependency tree with the TuxCare catalogue, pins the patched builds — through overrides or resolutions for transitive packages — and verifies that the installed tree really changed. In CI, securechain check fails the build when a patched build exists and the project is not on it.

Install the CLI
```
curl -fsSL https://securechain.tuxcare.com/get/securechain | sh
```
Docker, npm, pip, apt, dnf and other methods are listed in SecureChain CLI — Installation.
Set your token
Every securechain command reads the token from the TUXCARE_TOKEN environment variable. On your machine, export it in the shell where you run the commands. In CI, add it as a masked secret variable of the pipeline — the CLI picks it up from the environment the same way:
```
export TUXCARE_TOKEN=<TOKEN>
```
Replace <TOKEN> with your TuxCare CLN token.
Log in and connect the project
Run these in the root directory of your project:
```
securechain auth login
securechain init
```
auth login validates the token and remembers what your subscription covers. init writes the registry configuration (.npmrc, or .yarnrc.yml for Yarn 2+) and the project file .securechain.yaml.
See what is covered, then apply the patched builds
```
securechain check
securechain harden
```
check only reads: it lists every package that has a patched build and the CVEs that build closes. harden pins those builds, refreshes the lockfile, reinstalls and verifies the result. Add --dry-run to preview the change first.
Commit the changes
Commit the files init created together with package.json and the lockfile.

Every command, the options, CI usage and machines with no internet access are described on the SecureChain CLI page.

Option 2: Manual setup

Use this path if you prefer not to install the CLI. Select your subscription to see the matching setup steps:

Choose your subscription:

Choose your package manager:

Connect to the SecureChain registry
In the root directory of your project, create or edit .npmrc to point npm at the TuxCare registry and provide your token:
```
registry=https://artifacts.tuxcare.com/npm/
//artifacts.tuxcare.com/npm/:_authToken=<TOKEN>
```
Replace <TOKEN> with your TuxCare CLN token.
Refresh the project dependencies
If the project was previously installed against the public registry, remove the lockfile and node_modules, then install:
```
rm -rf node_modules package-lock.json
npm install
```
You can keep the package names and versions in package.json as they are.
The package manager is now pointed at SecureChain from the previous step, so the packages are pulled automatically from the TuxCare registry: SecureChain builds where they exist, and the public upstream packages for the rest — served through the same endpoint, so no other registry configuration is needed.
The freshly generated package-lock.json records the TuxCare URLs and checksums; commit it.
Verify the setup
Confirm the TuxCare packages are resolved correctly:
```
npm list
```
To see which versions of a package are available to your subscription, query the registry directly:
```
npm view <package> versions
```
To browse published CVE fixes across the catalogue, see the TuxCare CVE Tracker.

Troubleshooting

If npm install resolves to the public registry instead of TuxCare, use the commands below to verify that npm is reading your .npmrc and that the token is accepted.

pnpm, Bun and Yarn 1 (Classic) read the same .npmrc, so every check below applies to them as written (pnpm config get registry works too). For Yarn 2+ (Berry) the equivalent of the first check is yarn config get npmRegistryServer, and the token lives in .yarnrc.yml — see the Yarn tabs above.

Confirm the active registry
```
npm config get registry
```
The output must be https://artifacts.tuxcare.com/npm/. If it returns https://registry.npmjs.org/, npm is not reading your project .npmrc - check that you are running npm from the project root and that no user-level ~/.npmrc is overriding it.
Confirm authentication and connectivity
```
npm ping
npm whoami
```
npm ping must print PONG — it confirms the registry is reachable with your token. npm whoami succeeding (it prints a service identity, not your account name) confirms the token is accepted. Failures here usually mean a missing, malformed, or revoked token in .npmrc.
403 Forbidden on every request
The token is being sent in the wrong form. Use _authToken with the raw token as shown above; the _auth key requires the base64 encoding of <TOKEN>: instead.
EINTEGRITY checksum mismatch during install
The project still has a lockfile generated against the public registry, and the TuxCare build of that package legitimately differs from the public tarball. Delete package-lock.json and node_modules, then run npm install again (see the lockfile step above).
ETARGET / No matching version found for a -tuxcare version
The requested version exists but is not included in your subscription. Check the available versions with npm view <package> versions — the output reflects exactly what your token can install.