v0 can now pull packages from your private npm registry

v0 can now install packages from private or custom npm registries, using credentials stored as shared environment variables at the team level. Vercel published the change September 18, per its changelog entry.

The stakes are about what v0 generates, not just what it can install. Before this, v0 had no way to see a company's internal component library or a private fork of an open source package. It would generate code against the public equivalent, and someone had to swap in the real import by hand every time. Now the registry token lives on the team, not the individual session, so any generation in that workspace can resolve internal packages directly.

That convenience comes with the usual shared-secret tradeoff. A credential scoped to a team is easy to set once and forget. It's also harder to audit. Nothing in Vercel's changelog describes rotation policy or a way to scope the token to one project instead of the whole team's workspace.

So the token sits in an environment variable, available to every generation, indefinitely, until someone remembers to rotate it.

For teams already running v0 against a real internal package set, this closes a gap that's been mildly annoying since the tool first needed to reference anything off the public registry.