This is a follow on post to Setting Up a Private NPM Repository with Yarn and Verdaccio to illustrate publishing to Verdaccio. Verdaccio seems to work pretty well as a NPM proxy and private registry and comes with a web UI to browse your published packages and their dependencies.
Finally some bright sparks have worked out how to do public key encryption that most people could manage - not my mother-in-law - but the barriers to entry have been lowered a lot. Keybase uses or wraps PGP so they have not invented anything new but have “wrapped” it in a nice desktop (Electron I think) and device UI.
Coming from a fifteen year Maven background (maven 1 yikes) I at some point knew that I was going to need a private repo for JS while working for any company with their own private codebase. For a couple of years I used a combination of git repos and (shock horror) copy and paste to achieve code reuse but as the problem has been solved before and the whole point of NPM is to work in this way then it could be done.