--- title: Vercel Agent now installs private packages from npm and... description: Vercel Agent can now install private dependencies from npm and custom registries by reading credentials stored as shared environment variables. Adding... canonical: https://daily.dev/posts/vercel-agent-now-installs-private-packages-from-npm-and-custom-registries-4obqjls1g twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Vercel Agent now installs private packages from npm and custom registries | daily.dev og:description: Vercel Agent can now install private dependencies from npm and custom registries by reading credentials stored as shared environment variables. Adding... og:url: https://daily.dev/posts/vercel-agent-now-installs-private-packages-from-npm-and-custom-registries-4obqjls1g og:image: https://api.daily.dev/og/posts/4oBQjls1G.png og:image:alt: Vercel Agent now installs private packages from npm and custom registries og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Vercel Agent now installs private packages from npm and custom registries **[Vercel](https://daily.dev/sources/vercel)** · 1 min read · 2 upvotes · 1 comments ## Summary Vercel Agent can now install private dependencies from npm and custom registries by reading credentials stored as shared environment variables. Adding NPM_TOKEN authenticates with registry.npmjs.org, while NPM_RC supports custom or multiple registries. The agent reads only team-shared variables (not project-scoped ones), and credential values remain outside the sandbox so the agent itself cannot read them. npm, pnpm, and classic Yarn authenticate the same way they do during Vercel builds. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I let Vercel Agent install private npm packages during a build or session? Add a shared environment variable named NPM_TOKEN for Development or Preview to authenticate with private packages hosted on registry.npmjs.org. For custom or multiple registries, use NPM_RC instead. Vercel Agent only reads team-shared variables, not project-scoped ones, and credential values stay outside the sandbox so the agent cannot access them directly. _Developers wiring up private registries with Vercel Agent can track changelog updates like this on daily.dev._ ### Which package managers does Vercel Agent support for authenticating with private registries? npm, pnpm, and classic Yarn running inside Vercel Agent sessions authenticate the same way they do during regular Vercel builds, using credentials from shared environment variables like NPM_TOKEN or NPM_RC. This means existing authentication setups used for builds carry over directly to agent sessions without extra configuration. _Teams standardizing package manager auth across build and agent environments can follow updates like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > keeping the token out of the sandbox while still letting npm authenticate is a nice pattern, basically proxying the auth instead of handing out the secret. wonder how this holds up against a malicious postinstall script trying to exfiltrate env vars some other way. ## Similar posts on daily.dev - [pnpm 11.10 Hardens Registry Authentication to Block Token Re...](https://daily.dev/posts/pnpm-11-10-hardens-registry-authentication-to-block-token-re--fwa9evwsm) · Socket · 2 upvotes · 0 comments - [Vercel for Enterprise Apps and Agents](https://daily.dev/posts/vercel-for-enterprise-apps-and-agents-n0ckcbdnm) · Vercel · 1 upvotes · 0 comments - [pnpm 11.23](https://daily.dev/posts/pnpm-11-23-migxmswxe) · Fast, disk space efficient package manager \| pnpm · 3 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#npm](https://daily.dev/tags/npm), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/vercel-agent-now-installs-private-packages-from-npm-and-custom-registries-4obqjls1g) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Vercel Agent now installs private packages from npm and custom registries","url":"https://daily.dev/posts/vercel-agent-now-installs-private-packages-from-npm-and-custom-registries-4obqjls1g","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/vercel-agent-now-installs-private-packages-from-npm-and-custom-registries-4obqjls1g"},"datePublished":"2026-10-01T00:00:01.685Z","dateModified":"2026-10-01T00:00:20.918Z","description":"Vercel Agent can now install private dependencies from npm and custom registries by reading credentials stored as shared environment variables. Adding...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccedbb3fe06e0d3fce8b1b5461e76abf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccedbb3fe06e0d3fce8b1b5461e76abf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Vercel","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Vercel","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/04cca7235cf84db092f24b7ba427b3e1","url":"https://daily.dev/sources/vercel"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/vercel-agent-now-installs-private-packages-from-npm-and-custom-registries-4obqjls1g","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"ai-agents,npm,vercel","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Vercel","item":"https://daily.dev/sources/vercel"},{"@type":"ListItem","position":3,"name":"Vercel Agent now installs private packages from npm and custom registries"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/vercel-agent-now-installs-private-packages-from-npm-and-custom-registries-4obqjls1g","comment":[{"@type":"Comment","text":"keeping the token out of the sandbox while still letting npm authenticate is a nice pattern, basically proxying the auth instead of handing out the secret. wonder how this holds up against a malicious postinstall script trying to exfiltrate env vars some other way.","datePublished":"2026-10-01T18:18:09.705Z","url":"https://daily.dev/posts/4oBQjls1G#c-xTrK0HjIC","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/vercel-agent-now-installs-private-packages-from-npm-and-custom-registries-4obqjls1g#faq","mainEntity":[{"@type":"Question","name":"How do I let Vercel Agent install private npm packages during a build or session?","acceptedAnswer":{"@type":"Answer","text":"Add a shared environment variable named NPM_TOKEN for Development or Preview to authenticate with private packages hosted on registry.npmjs.org. For custom or multiple registries, use NPM_RC instead. Vercel Agent only reads team-shared variables, not project-scoped ones, and credential values stay outside the sandbox so the agent cannot access them directly. Developers wiring up private registries with Vercel Agent can track changelog updates like this on daily.dev."}},{"@type":"Question","name":"Which package managers does Vercel Agent support for authenticating with private registries?","acceptedAnswer":{"@type":"Answer","text":"npm, pnpm, and classic Yarn running inside Vercel Agent sessions authenticate the same way they do during regular Vercel builds, using credentials from shared environment variables like NPM_TOKEN or NPM_RC. This means existing authentication setups used for builds carry over directly to agent sessions without extra configuration. Teams standardizing package manager auth across build and agent environments can follow updates like this on daily.dev."}}]} ```