Box Sources

When installing a package using umbox install, or by adding it to the dependency list, it is possible to specify, where the box should be sourced. By default, if you don't specify anything, it is downloaded from the official server at


The syntax is very simple:


Source types

Currently there are two source types supported:

Dependency shadowing

Let's consider the following scenario:

UmBox will use the dependency source of the first reference to a box it sees. In this case, logs will be installed from a file, even for box2:

"dependencies": {

In this case, logs will be installed from the source specified by box2, even though we specify a different source ourselves:

"dependencies": {

It is a good idea to specify dependencies with custom sources first in the list to prevent any unexpected behavior.


Download from the official server:


Download from an alternative server:


Install from a file using relative path:


Install from a file using absolute path: