# GitHub Packages as npm proxy
**URL:** https://community.sonatype.com/t/github-packages-as-npm-proxy/5034
**Category:** Sonatype Nexus Repository
**Tags:** nexus-repository, github, npm
**Created:** [October 1, 2020, 12:48pm UTC](https://community.sonatype.com/t/github-packages-as-npm-proxy/5034 "2020-10-01T12:48:51Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@mareksierocinski](https://community.sonatype.com/u/mareksierocinski)
#### Post date: [October 1, 2020, 12:48pm UTC](https://community.sonatype.com/t/github-packages-as-npm-proxy/5034/1 "2020-10-01T12:48:51Z")
Hello,
is it possible to configure Nexus to use GitHub Packages as a npm proxy? HTTP authentication option doesn’t seem to work.
Here are GitHub docs how to do it locally: [Configuring npm for use with GitHub Packages - GitHub Docs](https://docs.github.com/en/free-pro-team@latest/packages/using-github-packages-with-your-projects-ecosystem/configuring-npm-for-use-with-github-packages)
But no luck with Nexus npm proxy.
---
### Author:  [@mareksierocinski](https://community.sonatype.com/u/mareksierocinski)
#### Post date: [October 1, 2020, 3:38pm UTC](https://community.sonatype.com/t/github-packages-as-npm-proxy/5034/2 "2020-10-01T15:38:44Z")
Update: I have updated Nexus to the newest Linux version (OSS 3.27.0-03). Now I have the option to setup HTTP Authentication as “Preemptive Bearer Token”. And now, it seems that Nexus can talk with GitHub npm repo, but there must be some a bug, because downloading tarball does not work. It responds with 404.
Help please?
---
### Author:  [@mareksierocinski](https://community.sonatype.com/u/mareksierocinski)
#### Post date: [October 1, 2020, 3:46pm UTC](https://community.sonatype.com/t/github-packages-as-npm-proxy/5034/3 "2020-10-01T15:46:58Z")
Update 2 and solution:
In my opinion there is some serious bug in Nexus. But it works. What you need to do is to use a classic HTTP Username authentication, as username you GH username, and as password - personal token. Now you _must_ uncheck checkbox “Validate that all content uploaded to this repository is of a MIME type appropriate for the repository format”… Which is stupid.
It will NOT work with “Preemptive Bearer Token”.
Sonatype, please fix this…
---
### Author:  [@mareksierocinski](https://community.sonatype.com/u/mareksierocinski)
#### Post date: [October 3, 2020, 7:19pm UTC](https://community.sonatype.com/t/github-packages-as-npm-proxy/5034/4 "2020-10-03T19:19:55Z")
Update 3:
Ok, that was not a solution. It seemed to work, but it didn’t - I was not able to install any other version of the package without invalidating the cache.
Here is a PR with the fix: [NEXUS-23750 - Does not support npm GitHub Package Registry by marverix · Pull Request #79 · sonatype/nexus-public · GitHub](https://github.com/sonatype/nexus-public/pull/79)
About issues and fixes:
**First problem**
Nexus is using HttpClient 4.5, which is using since version 4.1 DefaultRedirectStrategy. According to the [documentation](https://hc.apache.org/httpcomponents-client-ga/httpclient/apidocs/org/apache/http/impl/client/DefaultRedirectStrategy.html) :
> 302 Moved Temporarily, 301 Moved Permanently and 307 Temporary Redirect status codes will result in an automatic redirect of HEAD and GET methods only.
and (probably) HttpClient is copying all headers from the original request. Normally it’s not an issue, but GitHub Package Registry is redirecting (with 302) to an automatically generated AWS (S3 probably) link with the _X-Amz-Credential_ GET parameter. AWS does not allow us to use both the _Authorization Bearer token_ and the mentioned _X-Amz-Credential_ , and responses with HTTP 400.
The fix is to manually handle redirect, so we can use the _execute_ method to control if we should or shouldn’t add the _Authorization Bearer_ header (by checking the existence of _X-Amz-Credential_ ).
**Second problem**
In the _NpmContentValidator,_ Nexus was adding always a _.json_ extension if there was no extension at all. Which was wrong. npm packages’ names in AWS are just some random hashes without extension. But those are application/octet-stream - which is the tarball that we are expecting to get.
The fix is to check if the declared content type is application gzip. If so then let’s append .tgz instead .json.
---
### Author:  [@prashantthakur666](https://community.sonatype.com/u/prashantthakur666)
#### Post date: [August 5, 2022, 8:29am UTC](https://community.sonatype.com/t/github-packages-as-npm-proxy/5034/5 "2022-08-05T08:29:17Z")
I am facing the similar issue of 404 which started coming abruptly.
We are on nexus version -3.38.1
node version - v18.7.0
pnpm version - v7.8.0
I am using the proxy repo to connect to github and tried testing using the bearer token and even username and password as token.
Nothing was changed on Nexus side and things were working fine.
---
### Author:  [@emeric.colombe](https://community.sonatype.com/u/emeric.colombe)
#### Post date: [May 24, 2023, 11:50am UTC](https://community.sonatype.com/t/github-packages-as-npm-proxy/5034/6 "2023-05-24T11:50:22Z")
Hi Prashant, did you find a solution to your problem ?
I’m trying to install npm package aframe@1.3.0, but it fails on its three-bmfont-text dependency because it is hosted on github
---
### Author:  [@joris.klop](https://community.sonatype.com/u/joris.klop)
#### Post date: [September 18, 2023, 9:35am UTC](https://community.sonatype.com/t/github-packages-as-npm-proxy/5034/7 "2023-09-18T09:35:26Z")
Hi All,
Just got the proxy to GitHub Packages working on Nexus Repository 3.55 with the following:
Nexus Repo 3.55
Remote Storage URL: [https://npm.pkg.github.com](https://npm.pkg.github.com)
Authentication type: Preemptive Bearer Token (SO NOT the username one)
Token: OBTAINED\_TOKEN\_FROM\_GITHUB
Enabled: Enable redirects to the same location (may be required by some servers)
Enabled: Allow cookies to be stored and used
Other settings: Default
Hope above helps!
Kind regards,
Joris
---
### Author:  [@email](https://community.sonatype.com/u/email)
#### Post date: [May 7, 2024, 2:25pm UTC](https://community.sonatype.com/t/github-packages-as-npm-proxy/5034/8 "2024-05-07T14:25:35Z")
Hi All,
will this also work for Maven artifacts? (pom.xml, \*.jar, …) ?
I´m trying to setup a proxy Repo in Nexus for my Github package(s) - but couln´nt get that working.
Any advice would be very appreciated
Thx, Torsten