First-party hosting
Host any package with us.
Not just Damat modules — any npm-shaped package can be published to and served from the registry, GitHub-Packages style. It installs through the standard npm protocol, and it picks up everything npm never gave you: verification, scanning, verdicts, and a source-copy channel.
Publish
Push with the tools you already have.
Token-authed npm publish. Every published version is stored permanently, integrity-verified, and scanned like everything else.
Two ways to install
npm dependency, or the source itself.
Every package we host is installable both ways — the choice is yours, per package. Both channels serve the same stored artifact and pass the same gate.
npm channel
A normal dependency resolved into node_modules. Backward-compatible with every tool you already use.
Source-copy channel
The package source is vendored into your tree — visible, reviewable, no opaque bytes. Keep it intact and track upstream updates, or let it diverge and own it.
Zero migration
One line of .npmrc. That is the whole setup.
The registry speaks the npm protocol — packuments, dist-tags, tarballs, publish. Point your project at us and everything from npm CLI to bun to CI caches keeps working. Packages we do not host are proxied from npmjs.org through the same safety gate.
Get started