npm reads four npmrc files: the project .npmrc, the per user $HOME/.npmrc, a global file under the install prefix, and a built-in one shipped with npm. They are merged, and a user setting overrides the same setting in the global file. Run npm config ls -l to see the result.
The four files
| File | Path | Notes |
|---|---|---|
| Per project | .npmrc next to package.json | Not read in global mode, such as npm install -g |
| Per user | $HOME/.npmrc | Location can be changed with the userconfig setting |
| Global | $PREFIX/etc/npmrc | Location can be changed with globalconfig |
| Built in | Inside the npm install | Cannot be changed; meant for distribution maintainers |
The npm documentation gives one precedence example, that user config overrides global config, and does not list the full order on that page. So do not guess. Ask npm.
How to see where a value comes from
- Run
npm config ls -lto list effective settings. - Run
npm config get registryto see which registry will serve installs. - Open the project
.npmrcand your home.npmrcside by side.
Treat any unexpected line as a finding, especially registry, ignore-scripts, strict-ssl and anything with auth in its name.
Why a project .npmrc deserves review
A .npmrc in a cloned repository is read automatically when you run npm inside it. That is normal and useful, because teams use it to point at a private registry. It also means a repository can influence how your install behaves. Before running an install in a repo you do not control, read its .npmrc first.
A habit worth adopting
After cloning an unfamiliar repository, make reading its .npmrc part of your routine, right next to reading package.json scripts. It takes a few seconds. Then run npm config get registry inside the folder and confirm the answer is the registry you expect. Teams that do this catch typos in registry hostnames and leftover test settings before an install runs.
Credentials in npmrc
The npm documentation says auth settings must be scoped to a specific registry, which "ensures that npm will never send credentials to the wrong host". It also shows an unscoped _authToken as a bad config. Keep these rules:
- Scope every token line to its registry.
- Do not commit tokens. Use an environment variable reference in the project file and keep the real value in your user file or a secret store.
- Use tokens with the narrowest permission that works, and remove old ones.
Related: npmrc scoped registry and token scoping, and npm ignore scripts on a developer machine.
Safeguard scans dependencies and produces an SBOM for npm projects, whichever registry they came from. Try a free scan at gold.safeguard.sh/scan.
Quick check
Does the project npmrc apply when I install a tool globally?
No. The npm documentation says the per project file is not read in global mode.
Can a project npmrc change my registry?
Yes, for installs run inside that project. Read it before you install in an unfamiliar repository.
Sources
Last reviewed: 19 October 2026.
