Vercel Sandbox can now install your team's private npm packages using credentials stored in team Shared Environment Variables. Custom registries such as GitHub Packages and JFrog Artifactory are also supported.
Pass credentials: { npm: true } when creating a sandbox to let it use your team's existing npm credentials.
Tokens stay outside the sandbox. The firewall adds authentication to install requests sent to your configured registries, so a coding agent can install dependencies without seeing the tokens.
Update your Sandbox SDK or CLI to the latest version.
Read the npm credentials documentation to get started.